WordPress abuse on Linux servers
An address abusing WordPress's login or XML-RPC endpoints: password guessing against wp-login, or request after request to xmlrpc.php, from one address, and the agent blocked it.
The observatory is not answering just now. The numbers are rebuilt every hour; try again shortly.
What a block for this reason means
An address abusing WordPress's login or XML-RPC endpoints: password guessing against wp-login, or request after request to xmlrpc.php, from one address, and the agent blocked it.
Why it happens to every server
WordPress runs a large share of the web, so one working password or one old plugin is worth a lot of tries. The login and XML-RPC endpoints are where those tries land, and they land on every WordPress site, not on famous ones.
What to do about it
Strong passwords and two-factor login; XML-RPC disabled unless something uses it; plugins and core kept current. The free assessment reports the WordPress core version and whether it is behind.
How to read these figures
- Blocks, not attempts. An attack SecAI did not block is not counted, so these are floors.
- A small fleet. A handful of servers. The number of servers is next to every figure because it is part of what the figure means.
- No addresses, countries or ports. The address is used to count distinct sources and then dropped; the rest is not recorded on a block.
How this data is collected and what is left out · All categories
Also published: SSH password guessing, Web scanning and probing, Floods and connection exhaustion.
Free to reuse with credit (CC BY 4.0). Cite as: SecAI Threat Observatory, WordPress abuse, https://secai.techsteps.ae/threats/wordpress. The same counts are in the JSON at https://secai.techsteps.ae/api/public/threats, rebuilt hourly.
Questions
Not enough of it on the servers SecAI monitors to publish a figure: a category is published only once it has been seen on several servers with enough events to be anonymous.
One block: an address the agent blocked on a customer's server for this reason, and confirmed it had blocked. Distinct addresses are counted separately, because one address can be blocked many times.
No. The published tables hold counts by day and category. The attacker's address is used to count distinct sources and then discarded; no customer address, hostname or server identifier is stored or served, and a day or category seen on too few servers is withheld.
Is your server in this already?
The free assessment reads how your server is set up and tells you what an attacker would find, in about a minute, without changing anything.