Thousands of 404 errors on /xmlrpc.php and /wp-login.php?

wp-login.php is how you log in to your site, and xmlrpc.php is how connected services and apps can communicate with your site.

If you have removed or otherwise moved these files, 404 errors are to be expected.

@macmanx

Thank you for your reply.

However, these two files are all there. I do not remove them. Why I still get 404 errors on them?

Perhaps your server or a security plugin is returning a 404 for entities that aren’t approved?

@macmanx

That is possible. I install WordFence and iTheme Security plugins, though I do not make such a setting by purpose.

Hm, first I definitely recommend only using one of the two. It doesn’t matter which one, but stacking two comprehensive security plugins generally leads to more problems than anything else.

@macmanx

Thank you for your suggestion.

Originally I only use WordFence. However, I encounter 10 of thousands of DoS attackers everyday and I want to hide the WordPress login URL by chaning it to a customized one, while WordFence does not have such a feature. I have to install iTheme Security to do the task. Is there any good ways to solve the problem?

In that case, try only iThemes Security and see how how that goes for a few days.

@macmanx

Thank you very much.