In reply to Samuel "Otto" Wood.

Samuel, "they" chose XMLRPC for a reason. Except wp-login.php, it is the only door that is so easy to attack and to overload a server. And hard to protect. I can restrict IP addresses to login on Wordpress, can check if a request is coming from a browser ( "they" do mistakes ) or can even move wp-login.php to a new location. But the only way to stop XMLRPC DDos attacks is to close the door. I would be grateful for an advice if you know a better solution.