You can block xmlrpc.php and wp-login.php via NGINX with the following configs

xmlrpc.php for NGINX

location = /xmlrpc.php {
deny all;
}

To allow JetPacks IP addresses through adjust the config to allow certain IPs

location = /xmlrpc.php {
allow 192.0.64.0/18;
allow 64.34.206.0/24;
allow 198.181.116.0/22;
allow 66.155.105.128/26;
allow 69.90.253.0/24;
allow 76.74.248.128/25;
allow 76.74.255.0/25;
allow 2001:1978:1e00:3::/64;
allow 2620:115:c000::/40;
deny all;
}

wp-login.php for NGINX

You would want to allow at least 1 IP address for backend access…

location = /wp-login.php {
allow 1.2.3.4;
deny all;
}

If you wanted more IP addresses just add additional allow lines.

 

Test your new config by tailing the error log…

tail -f /home/<user>/logs/nginx/webapp_error.log

Visit the xmlrpc.php and wp-login.php via IP addresses not allowed to see a 403 error.

Share:

Leave a Reply