How to stop wp-login.php and xmlrpc.php attacks

Use strong passwords with two-factor authentication, rate limit wp-login.php, and turn off xmlrpc.php if nothing needs it. Requests for these files are routine background noise on the internet, even on sites that do not run WordPress.

1. Protect the accounts

Use unique passwords and two-factor authentication for every administrator, remove old accounts, and keep WordPress and its plugins updated. Most other steps only reduce the volume of attacks.

2. Rate limit the login page

With nginx, add this to the http block:

limit_req_zone $binary_remote_addr zone=wplogin:10m rate=6r/m;

Then add this to the server block, with your usual PHP settings inside it:

location = /wp-login.php {
    limit_req zone=wplogin burst=5 nodelay;
    # your existing fastcgi_pass and PHP settings
}

Behind a proxy or CDN, set up the real client address first, or all your visitors will share one limit.

3. Turn off XML-RPC if you do not need it

location = /xmlrpc.php {
    deny all;
}

Check first, because some plugins and the mobile apps can depend on it.

4. Report and block attackers

The WordPress integration reports login floods automatically. To block known attackers, use the blacklist with nginx or Cloudflare. The web application attack report shows current activity.