3

I currently own a WordPress site in a hosting (BlueHost). On the other hand, I have an application in our offices in .Net. This application, updates WordPress via XMLRPC every 1 hour.

The problem is that my IP is temporarily blocked every day.

I am trying to understand what kind of solution exists to these problems. From the hosting service, they tell me that there are many attempts to login via email. They see it as email, but I know it's via XMLRPC.

  1. Is there any way to avoid being taken as SPAM, since it really is not?
  2. Is the only solution to make fewer connections? They tell me 3 or 4 per day. I need 24.
  3. Is there a solution at the hosting configuration level to be able to put the source IP in a white list?

I guess it must be a fairly common problem, that's why I ask it here. From already thank you very much.

If you need additional information about the way I connect, I can add the source code.

UPDATE

Answer from bluehost:

Thank you for contacting support. We have received your case for your IP getting blocked continuously. This is highly unusual and uncommon for an IP to get listed this much. It seems you're using the xmlrpc.php for logging in this is a common practice that we see malicious attempts from. This is because malicious attempts will try to exploit that file to gain access that they should not. I would highly recommend switching back to a standard login procedure.

UPDATE 2:

Second answer fro hosting:

We are following up on your case regarding your XMLRPC logging. Unfortunately the blocking is due to a Mod Security rule within your shared server. This is a security rule within our Mod Security configurations which cannot be removed in a shared server environment. Essentially we have these Mod Security rules set up to prevent customer's from being vulnerable to exploits which XMLRPC can allow such as: https://null-byte.wonderhowto.com/how-to/gain-control-wordpress-by-exploiting-xml-rpc-0174864/

  • Once an hour doesn't sound like "many" to me? And 3-4 per day is very few. Is your script perhaps creating more connections than you are aware of? "many attempts to login via email" - are they talking about "others", not just you? Why are they associating "email" with XMLRPC? Since they are "blocking" your IP address then they can obviously white-list your IP address, but whether they are willing to do this is another matter? Seems strange that they would put such restrictions on this given it is something they publicly document on their website. – DocRoot Nov 12 '18 at 17:22
  • Thanks DocRoot. I think the support service has generic answers about IP locks. That's why they confuse with email. You made me think and I found in another hosting a warning about XMLRPC. Maybe my code should look "a little more" go through a "human". Check this link: a2hosting.in/kb/security/temporarily-banned-ip-addresses – jpussacq Nov 12 '18 at 18:40
3

A little history...

SOURCE

XML-RPC has been enabled as default since WP version 3.5, with XML-RPC support enabled you can post to your WordPress blog using many popular 3rd party Weblog Clients,. Sadly, this is another entry point for hackers to gain access to your website.

Most WordPress administrators don't even use XMLRPC

In fact most webmasters have no idea what that file does and this is why most shared hosts simply block it entirely or restrict it. Hosts that do not block and for website administrators that do not use it then its recommended by the security community simply to block it by doing:

Renaming xmlrpc.php

mv xmlrpc.php randomstring.php

Deleting xmlrpc.php

rm xmlrpc.php

.htaccess Deny

<FilesMatch "xmlrpc.php">
  Order Deny,Allow
    deny from all
</FilesMatch>

But occasionally there are instances when xmlrpc.php is actually helpful but how do you benefit from it but not be attacked at the same time and get around system blocks?

The simplest method is to rename it, you can do this by using the file system method e.g via SFTP, FTP, SSH etc, or use one of several plugins that are available on the WordPress plug-in library.

Most hosts block by filename, so effectively renaming it, will provide you with a workaround and it'll make your site more secure. You should expect a lot of 404 errors in your logs since those bots sniffing will cause that, 404s does not indicate your site is broken, in fact, is confirmation in this case that it's working.

If you prefer you can use the rename method and then use the DENY block mentioned above. You can, of course, get inventive and redirect them to a website with a HUGE page size which could/would cause a lot of poorly made bots to simply crash, e.g:

redirect 301 /xmlrpc.php http://www.example.com/bigpagesize.html
  • Lets see if I understand. You say that if I rename the file, Bluehost will probably stop blocking me? – jpussacq Nov 13 '18 at 11:25
  • Yes, correct, try it. – Simon Hayter Nov 13 '18 at 12:19
  • Let me see if I understand. You say that bluehost does not know what method of the XMLRPC API I'm using to connect. Just note that I access the XMLRPC file very often and it blocks me. Because they know it's a security hole. So if I change the name, BlueHost will never find out? I'll try it, I need some time because it's production environment. – jpussacq Nov 13 '18 at 13:58
  • I addet a second update from the hosting. I think it can help. And they add this URL: null-byte.wonderhowto.com/how-to/… Thanks! – jpussacq Nov 13 '18 at 18:35
  • 1
    Err? mod_security is a simple Apache module, it does not have some complex algorithm that detects XMLRPC, they will be using a simple <Locationmatch "/xmlrpc.php"> by renaming the file bots can't attack that file, in fact they have no way of knowing what your renamed it too, unless they have list access which you don't since index.phpis present then there is absolutely no way they can find out unless you 1. tell them, 2. your host is compromised outside your account. If your host forbids this method then sorry to say but you need a need host fit for your needs. – Simon Hayter Nov 13 '18 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.