In reply to Jan Dembowski.

think you need to? ... XML-RPC is a problem if you don’t have strong passwords.

Need to.

Trying to be brief.
hosting a friends wp site - it got hacked.
cleaned the files. reinstalled. made strong pass - changed limit logins to 2 tries, 2 lockouts - 9600 hours. Had sucuri, a few other things. It gets hammered with failed attempts. I'm getting tons of notices. I'm looking up IPs, adding cidrs to htaccess deny.. I'm blocking countires from accessing the site - writing abuse complaints to ISPs.. this is going on for a few days. I stumble upon "IP GEO Block" - wow, made a HUGE difference.

Two days later, tons of emails failed login attempts, blocks.. I'm going back to same thing looking up cidrs.. this botnet wanting back in to this site bad. I added firewall plugins, captchas, only allowed American IPs to get to xmlrpc and wp-login - I'm collectin passwords, and it was quite trippy to see them get 20 password attempts per ip even though settings were to allow only two. I went looking for help, suggested addons for plugins.. and eventually - deleted xmlrpc and indeed I did rush and delete login.php -

1 problem solved. (until the next WO auto-update which I assume will replace those files and the bots will be back)

Not all my sites get hammered like this so repeatedly - it usually only comes hard like that about 2 days a month. (Collecting the failed passwords from these is interesting)

I have watched the most amazingly smart and adaptable group of hackers change tactics with everything .. trying to be brief.

2nd problem - MySql

A bit of a perfect storm, however, even though WP can run pretty solid when there is not too much bloat added with too many plugins, on a dedicated box.. A different site on that server was hacked - and these guys added about 5,000 html files in sub directories and got them indexed by baidu, naver and some other agressive places - it was getting hammered by these bots non stop and (ahrefs bots and others!) - even though I deleted all those files - WP was doing it's dynamic ? string url thing - server is humming just serving tons of non-really there pages.. that's another blocking adventure..

While this is going on, the other wp sites are getting hammered with password guesses, and MySql starts to choke. I'm getting failed to connect, can't even get in and work in the admin backend for periods of time - as there are hundreds of requests per domain name all coming in and attempting to be served like no tomorrow.

Several others of sites have been hacked - even with more than average measures in place.

For a while I saved a TON of sql resources by adding an htpssw / htaccess thing that host gator posted some time ago - it added an apache Auth to anyone trying to load wp-login - that was awesome - most bots blocked, no sql getting hammered..

but then this xmlrpc thing started being used more and more - and I did not understand how they were getting past my auth - thing - thank goodness sucuri posted info about this and I was able to determine it needs to be dealt with.

I appreciate your other info Jan - nice to see that. I would love to see wp Org put some of that info more prominent on the main pages there somewhere.. using wp org and the theme / plugin repo for years, and I only recently discovered the make.place.. after some posts on the Tavern here. I like to keep up with what's coming to know how bad it's going to break our sites. That dang title tag thing changing here lately is an interesting challenge. Things about themes needing to use the customizer, no theme options - important stuff!

Love to see if more prominent in the places the average WP user is likely to visit. I stumbled upon them shaper and underscores only because of reading about some lawsuit.. I'd love to see themeshaper info posted prominently in the dot ORg / themes section! (of course once the tutorials are no longer outdated)

I appreciate that the core team is trying to please a lot of people, and is open to new things - that is great. Honestly for most of the 100 or so WP sites I try to keep maintainedm we'd be fine with WP 1.5, or a static generator or something. We don't need all the fancy things WP can do, but we do need a way to keep secure and lightweght, without keeping up with semi-hidden things wordpress (the google fonts thing threw me for a loop) - (xmlrpc used as password guesser) - then we'd have no WP sites running at all - and keeping up with these changes has been a challenge. Just about every new feature since 1.5 would of been better for us as plugin, not enabled - and never downloaded. We could use a lean press like the old branches I see some places doing(and noticed wp is kind of doing with some security patches for older versions).

I am glad there are some heads up on these things posted at the Tavern - as it shows up in the dashboard. Thankful places like sucuri are doing their thing. So thankful for ip geo block these days, and looking forward to those bots going elsewhere and hammering everyone's else's stuff and leaving ours alone - lol.