How to Protect a Linux VPS Against Brute Force and XML-RPC Attacks: Complete Guide — CLIQHOST

Brute Force attacks and exploitation of the XML-RPC endpoint in WordPress are two of the most common active vulnerabilities server administrators face in 2024. Whether you run a NVMe VPS or a dedicated server, knowing how to block these attacks is essential for keeping your web applications secure.

This guide walks you through proven, step-by-step methods to stop Brute Force attacks (SSH, admin panel, login forms) and neutralise XML-RPC exploitation using open-source tools available on any Linux distribution.

What Are Brute Force Attacks and Why Are They Dangerous?

A Brute Force attack involves automated tools trying thousands or millions of username + password combinations until the correct one is found. Attackers use distributed botnets spread across many geographic regions, making simple IP blocking ineffective.

Primary targets:

SSH (port 22) — direct server access
wp-login.php — WordPress admin panel
phpMyAdmin, cPanel, Plesk — database and hosting management interfaces
Login forms of any web application

A successful attack can lead to:

Complete server takeover
Malware or ransomware infection
Server added to a botnet
Customer data breach

What Is XML-RPC and Why Is It Vulnerable?

XML-RPC is a remote communication protocol for WordPress, enabled by default and accessible at /xmlrpc.php. Although originally useful for mobile apps and external integrations, it is now heavily exploited for:

Brute Force amplification — a single XML-RPC request can test hundreds of passwords simultaneously via the system.multicall method
DDoS — flooding the /xmlrpc.php endpoint
Pingback attacks — using your WordPress site as a reflector in DDoS campaigns

⚠️ If you don't use features requiring XML-RPC (Jetpack, WordPress mobile apps), disable it immediately.

Step 1: Protect SSH Against Brute Force

1.1 Change the Default SSH Port

Edit the SSH configuration:

nano /etc/ssh/sshd_config

Change the line to:

Port 2222

Then restart the service:

systemctl restart sshd

Remember to add the firewall rule before restarting!

1.2 Disable Password Authentication (Use SSH Keys)

In the same /etc/ssh/sshd_config file:

PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

This single step eliminates virtually 99% of SSH Brute Force attacks. For more security tips, visit the CLIQHOST blog.

1.3 Restrict SSH Access via AllowUsers

AllowUsers adminuser

Step 2: Configure Fail2Ban for SSH, Nginx, and Apache

Fail2Ban monitors logs and automatically bans IP addresses with suspicious activity. Install on Ubuntu/Debian:

apt update && apt install fail2ban -y

2.1 SSH Jail Configuration

Create /etc/fail2ban/jail.local:

[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 5

[sshd]
enabled  = true
port     = 2222
logpath  = /var/log/auth.log
maxretry = 3

Add to /etc/fail2ban/jail.local:

[nginx-wp-login]
enabled  = true
port     = http,https
filter   = nginx-wp-login
logpath  = /var/log/nginx/access.log
maxretry = 5
bantime  = 86400

Create the filter at /etc/fail2ban/filter.d/nginx-wp-login.conf:

[Definition]
failregex = ^<HOST> .* "POST /wp-login.php
ignoreregex =

2.3 XML-RPC Jail

[nginx-xmlrpc]
enabled  = true
port     = http,https
filter   = nginx-xmlrpc
logpath  = /var/log/nginx/access.log
maxretry = 2
bantime  = 86400

Create the filter at /etc/fail2ban/filter.d/nginx-xmlrpc.conf:

[Definition]
failregex = ^<HOST> .* "POST /xmlrpc.php
ignoreregex =

Restart Fail2Ban:

systemctl restart fail2ban
fail2ban-client status

These configurations work effectively on both SSD VPS and dedicated servers for moderate-to-high traffic workloads.

Step 3: Block XML-RPC at the Web Server Level

3.1 Blocking in Nginx

Add to the WordPress site's server {} block:

location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
    return 444;
}

Code 444 tells Nginx to close the connection without sending any response — ideal for minimising resource consumption.

nginx -t && systemctl reload nginx

3.2 Blocking in Apache

Add to .htaccess or VirtualHost:

<Files xmlrpc.php>
    Require all denied
</Files>

Or more aggressively with mod_rewrite:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^xmlrpc\.php$ - [F,L]
</IfModule>

4.1 IP Restriction (Nginx)

If you access the admin panel from a static IP:

location = /wp-login.php {
    allow 193.168.1.100;  # Your IP
    deny all;
}

4.2 HTTP Basic Authentication (Nginx)

Create the password file:

apt install apache2-utils -y
htpasswd -c /etc/nginx/.htpasswd adminuser

Add to the server {} block:

location = /wp-login.php {
    auth_basic           "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

4.3 HTTP Basic Authentication (Apache)

<Files wp-login.php>
    AuthType Basic
    AuthName "Restricted Access"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Files>

This is especially useful on WordPress shared hosting where cPanel provides an intuitive interface for managing .htpasswd files.

Step 5: Disable XML-RPC in WordPress

5.1 Via functions.php

Add to your active theme's functions.php:

// Completely disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');

// Remove X-Pingback header
add_filter('wp_headers', function($headers) {
    unset($headers['X-Pingback']);
    return $headers;
});

// Disable pingbacks
add_action('pre_ping', function(&$links) {
    $links = [];
});

5.2 Via Plugin

The Disable XML-RPC plugin (free on WordPress.org) handles everything with a single click — recommended for users without code access.

Step 6: Nginx Rate Limiting to Prevent Mass Attacks

Rate limiting prevents request flooding even when attackers rotate IP addresses:

http {
    limit_req_zone $binary_remote_addr zone=wplogin:10m rate=5r/m;
    limit_req_zone $binary_remote_addr zone=xmlrpc:10m rate=1r/m;
}

server {
    location = /wp-login.php {
        limit_req zone=wplogin burst=3 nodelay;
        # ... rest of configuration
    }

    location = /xmlrpc.php {
        limit_req zone=xmlrpc burst=1 nodelay;
        deny all;
    }
}

Step 7: Configure UFW Firewall for Additional Protection

ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp   # SSH on new port
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

For managed dedicated servers, the CLIQHOST team can handle full firewall configuration and server hardening on your behalf.

Step 8: Monitoring and Alerts

Check SSH Authentication Logs

journalctl -u ssh --since "1 hour ago" | grep "Failed"

Check Active Fail2Ban Bans

fail2ban-client status sshd
fail2ban-client status nginx-xmlrpc

Install logwatch for Daily Reports

apt install logwatch -y
logwatch --output mail --mailto [email protected] --detail high

Additional Security Measures

SSL/TLS Certificates

Always enforce HTTPS. Without encryption, even strong passwords can be intercepted in transit. Get an SSL certificate directly through CLIQHOST.

Two-Factor Authentication for WordPress

Install the WP 2FA or Google Authenticator plugin — even if an attacker obtains a password, they cannot access the admin panel without the second factor.

Keep Everything Updated

apt update && apt upgrade -y

Keep WordPress core, themes, and plugins updated — the majority of active exploits target outdated software.

Security Hardening Checklist

Measure	Status
SSH port changed	✅
SSH key-based authentication	✅
Fail2Ban active (SSH + WP)	✅
XML-RPC blocked in Nginx/Apache	✅
XML-RPC disabled in WordPress	✅
Rate limiting enabled	✅
wp-login.php protected with HTTP Basic	✅
UFW Firewall enabled	✅
SSL certificate installed	✅
2FA enabled for WordPress	✅

Conclusion

Brute Force attacks and XML-RPC exploitation are not theoretical threats — they happen every single day across thousands of servers worldwide. By implementing the measures in this guide — from Fail2Ban jails and Nginx blocking rules to completely disabling XML-RPC — you dramatically reduce your attack surface and protect both your data and your clients'.

If you prefer a fully managed approach, the CLIQHOST team offers comprehensive server management services, including security audits and proactive hardening. Explore our NVMe VPS plans — high-performance, secure infrastructure ready for your production workloads.

How to Protect a Linux VPS Against Brute Force and XML-RPC Attacks: Complete Guide — CLIQHOST