Serve static 410 for bots hitting wp‑login & xmlrpc
Serve static 410 for bots hitting wp-login & xmlrpc
If your WordPress site is frequently targeted by bots attempting to access wp-login.php and xmlrpc.php, it can lead to increased server load and security risks. A quick and effective way to mitigate this is by serving a static HTTP 410 Gone response to these requests. This tells bots that these endpoints are permanently gone, discouraging repeated access attempts.
Quick Fix
- Identify your web server type (Apache, Nginx, LiteSpeed, etc.).
- Add the appropriate configuration snippet to serve a 410 response for
wp-login.phpandxmlrpc.php. - Reload or restart your web server to apply changes.
- Test by accessing these URLs and confirm you receive a 410 Gone status.
Why this happens
WordPress sites commonly expose wp-login.php and xmlrpc.php files, which are often targeted by bots for brute-force attacks or exploiting XML-RPC vulnerabilities. While legitimate users need wp-login.php to log in, many sites use alternative login methods or restrict access via plugins or IP whitelisting. Similarly, xmlrpc.php is rarely needed and often disabled to prevent abuse.
Serving a 410 Gone status explicitly informs bots that these endpoints are no longer available, reducing unnecessary server load and improving security posture.
Requirements
- Access to your web server configuration files or control panel (e.g., Apache
.htaccess, Nginx config, LiteSpeed config). - Basic knowledge of editing server config files or ability to upload files via FTP/SFTP.
- Ability to reload or restart your web server after changes.
- Optional: Backup your configuration files before editing.
Step-by-step
1. Determine your web server
Check your hosting environment or server info to confirm if you use Apache, Nginx, LiteSpeed, or another server.
2. Add configuration to serve 410 for wp-login.php and xmlrpc.php
Apache (.htaccess)
# Serve 410 Gone for wp-login.php and xmlrpc.php
<FilesMatch "^(wp-login.php|xmlrpc.php)$">
Require all denied
Redirect gone /
</FilesMatch>
Alternative Apache method:
# Return 410 Gone for wp-login.php and xmlrpc.php
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/(wp-login.php|xmlrpc.php)$ [NC]
RewriteRule ^ - [G,L]
Nginx
# Return 410 Gone for wp-login.php and xmlrpc.php
location ~* ^/(wp-login.php|xmlrpc.php)$ {
return 410;
}
LiteSpeed
LiteSpeed supports Apache-style .htaccess rules, so use the Apache snippets above.
3. Save and apply changes
After adding the code:
- For Apache or LiteSpeed, save the
.htaccessfile in your WordPress root directory. - For Nginx, add the snippet to your server block configuration file (e.g.,
/etc/nginx/sites-available/your-site.conf). - Reload or restart your web server:
# Apache
sudo systemctl reload apache2
# Nginx
sudo systemctl reload nginx
# LiteSpeed (depends on setup, often via control panel)
4. Test the response
Use curl or a browser to verify the 410 response:
curl -I https://yourdomain.com/wp-login.php
HTTP/1.1 410 Gone
curl -I https://yourdomain.com/xmlrpc.php
HTTP/1.1 410 Gone
If you see 410 Gone, the configuration works correctly.
Common pitfalls
- Incorrect file placement: Apache
.htaccessmust be in the WordPress root directory. - Conflicting rules: Other rewrite rules or security plugins may override or conflict with these directives.
- Server caching: Some hosts use aggressive caching; clear caches after changes.
- Access needed: If you still need legitimate access to
wp-login.php(e.g., for admins), consider restricting by IP instead of serving 410. - Control panel overrides: Some managed hosts restrict direct config edits; check with your provider.
Works on
| Web Server | Supported | Notes |
|---|---|---|
| Apache | Yes | Use .htaccess or main config files |
| Nginx | Yes | Requires editing server block config |
| LiteSpeed | Yes | Supports Apache-style .htaccess rules |
| cPanel | Yes | Access .htaccess via File Manager or FTP |
| Plesk | Yes | Supports Apache and Nginx config editing |
FAQ
1. Will serving 410 break my login or XML-RPC functionality?
Yes, if you or your users rely on wp-login.php or xmlrpc.php, serving 410 will block access. Use this only if you have alternative login methods or have disabled XML-RPC.
2. Can I serve 403 Forbidden instead of 410 Gone?
Yes, 403 is common for blocking access, but 410 explicitly signals the resource is permanently gone, which…