thousands of failed login attempts through xmlrpc.php

  • Resolved sebas6691

    (@sebas6691)


    5 years, 9 months ago

    Hi,

    I’m getting approximately 1500 failed login attempts for one of my admin accounts.

    The IP address is whitelisted. But for some reason I get a failed login attempt 15 times a minute in my log through xmlrpc.php. I’ve disabled xmlrpc.php through WP Cerber.

    That specific admin account can login just fine, but the log is filling up with these errors.

    How’s this possible and how to solve this issue?
    Thanks!

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author gioni

    (@gioni)

    Hi! What events are being logged for those failed login attempts? Is it “XML-RPC request denied” or something else? Check the Activity log.

    Thread Starter sebas6691

    (@sebas6691)

    Login failed

    URL: …./xmlrpc.php
    Admin name is correct though.

    I checked the IP and it turns out it’s our Varnish Cache server. Not sure why this is happening.

    Plugin Author gioni

    (@gioni)

    If an IP is whitelisted, it has access to XML-RPC even if it’s disabled. This is how whitelisting works. So if the IP of your Varnish Cache server is whitelisted, you can see those “Login failed” log entries.

    Make sure that Cerber detects IP addresses correctly: https://wpcerber.com/getting-started/

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘thousands of failed login attempts through xmlrpc.php’ is closed to new replies.