Hi @dwhswebhosting, thanks for your question.
Comment spam through XML-RPC is common, so disabling it (if you’re able to) is always the best place to start. Restrict XML-RPC by checking the “Disable XML-RPC authentication” checkbox in Wordfence > Login Security > Settings to prevent authentication attempts through that file.
If you’re not using Jetpack or the WordPress app, you could try disabling access to this route altogether via your .htaccess file with:
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
We don’t currently extend our own reCAPTCHA beyond the WordPress and WooCommerce login/registration pages, although some anti-spam plugins do have the option to add reCAPTCHA to your comment forms if you determine they are coming directly through your site rather than XML-RPC.
Many thanks,
Peter.
