Really Simple Security: A problem was detected during the loading of the settings. The request returned the following errors:
Response code: invalid_data
Status code: 500
Server response: WP Security Safe: Access blocked.
I have two domains hosted by one host (A2 hosting). I want to manage my websites using WordPress app but it keeps showing that ‘XML-RPC methods missing on the server’ when using either of the site address to log in. To be hnost. I am not quite sure what the ‘XML-RPC’ is. After researching the articles related the similar issue in this forum, I tried de-activating all the plugins, reinstalling WordPress as well as contacting A2 Hosting (host) but to no avail. The host told me they tested the access through web browsers and found no issues so they believe that it is the third party issue. In other ward, they meant the WP app. I tried another app, Jetpack as well. Unfortunately, it is still the same result. Does anyone have better ideas on that? Thank you
]]>I have a site in which, after activating an activity log plugin, I have discovered unauthorized admin account logins despite changing password multiple times, using long randomly generated passwords. I have already blocked xmlrpc.php using a plugin. When I checked visit logs in C-Panel, matching the suspicious login IP address and time to that recorded in the dasboard’s activity log (plugin), it looks like login was via example.com/wp-json/wp/v2/users (where example.com is our own url) which I think has something to do with REST API. It looks like the hacker was able to somehow login WITHOUT a password.
I understand I can easily disable the /wp-json/wp/v2/users but we NEED REST API because xmlrpc.php has been disabled (which helped reduce brute force attack) and we have plugins (such as Mail SMTP) that require connections to third party sites such as Google (where secret keys are used). How can I secure the site and still be able to use REST API?
]]>In January 2024, I installed a new website and disabled XML-RPC authentication, as I do for every website I install. During maintenance today, I noticed a large number of brute force attacks on /xmlrpc.php (error 503). I don’t know if this has been the case from the beginning or not. I never experienced this before with the other websites.
In the meantime:
I disabled and reset the XML-RPC authentication by marking the option. I’m still getting brute force attacks on /xmlrpc.php.
I also checked the diagnostics but this seems ok.
Any thoughts? Thank you & regards,
Hilde.
PS. I am on the latest version 7.11.3
]]>thanks
]]>I can’t connect my website to Jetpack, I have the following error: “Jetpack can’t communicate with your site because XML-RPC is not responding correctly.”
I tried to deactivate all my plugins and I checked in the wp-config.php, nothing is about xml-rpc.
I’m a little bit lost right now, I could not find any more help on other forums.
My website is https://finidejouer.com
Thank you
]]>But still, when I go to mywebsite.com/xmlrpc.php, I get this message:
XML-RPC server accepts POST requests only.
which means the xmlrpc file is still accessible.
I’m using the Nginx server
How do you think I could fix this?