Case: XML-RPC Pingback Flood Killed at 41k req/day

Case: XML-RPC Pingback Flood Killed at 41k req/day
Client ran a 9-site WordPress fleet. /xmlrpc.php took 41,200 hits/day, mostly system.multicall credential stuffing. PHP-FPM hit 100% CPU twice weekly.

What we ran:

— Step 1: Confirm zero legitimate use. Grep 30 days of access logs for non-attacker POST /xmlrpc.php — found 0.
— Step 2: Deny at nginx, not PHP. location = /xmlrpc.php { deny all; return 403; }
— Step 3: Block system.multicall at WAF as backstop for the one Jetpack site that needed XML-RPC.
— Step 4: Re-pull logs after 7 days.

Outcome: PHP-FPM peak CPU dropped from 100% to 34%. Origin bandwidth fell 18%. Zero CPU-exhaustion incidents in 90 days since.

Run this every time.