In reply to Marko Heijnen.

It would be really helpful to hear the ideas behind your improvements to xmlrpc.

Simple facts for me: I just recently setup 2 wordpress sites, withing couple weeks both got slow and unresponsive (even though both were on VPS). Some digging revealed periodic POST pings to /xmlrpc.php with some CPU heavy operations consuming workers.. So in the end solution was the same - block /xmlrpc.php and problem went away immediately.

As for REST API - the biggest benefit there is protection, you will need keys to access API!

Another observation - about a week ago I was under 1.5GB/s DDoS attack which was mitigated using Incapsula protection. Most of the traffic came from Wordpress clients. There is no way to protect against more or less seriouse DDoS attack with just Nginx as you mentioned.

Anyways, looking forward to your explanation of awesomeness of xmlrpc in wordpress and why is it enabled by default. It's a big mistake in my mind and already bit me in the ass couple times..