Prioritize secure transmission methods
Replace XML-RPC with WordPress REST API (higher risk) and force to enable HTTPS encrypted data transfer to avoid plaintext leakage.
Enhanced authentication
Enable OAuth 1.0a or application password authentication, disable simple HTTP base authentication; with two-factor authentication (2FA) and reCAPTCHA authentication to eliminate brute force.
1. Preferred: OAuth 1.0a authentication (most secure)
- Applicable Scenarios: Third-party tools / custom programs to remotely invoke REST APIs
- principle: Generate signatures via “Consumer Key” and “Consumer Secret”, each request contains a timestamp and a random number, avoiding the transmission of keys in the clear.
- dominance: No need to expose account passwords, supports fine-grained permissions control (e.g., only “publish article” operations are allowed), and cannot reuse signatures even if the request is intercepted.
- implementation method::
- Install a plugin (e.g. WP OAuth Server) to enable the OAuth service on the WordPress side;
- Third-party tools (e.g., Python scripts, client programs) generate signature requests through OAuth libraries (e.g., oauth1-requests).
2. Secondary: Application Passwords (natively supported by WordPress)
- Applicable Scenarios: Lightweight remote publishing (e.g., script automation, simple tool integration)
- principle: Generate separate “application passwords” (not login passwords) for WordPress users, tied to usernames, with support for separate revoke.
- dominance: Native support (WordPress 5.6+), no additional plugins required, prevents master password leaks, and simply revokes the app's password after a leak.
- caveat::
- HTTPS must be forced on (otherwise passwords are transmitted in clear text);
- It is recommended to generate different passwords for different purposes (e.g. “Script Publishing” and “Tool A”).
Restricted access
Assign minimal permissions such as “author” to remote publishing accounts, and set up IP whitelisting via .htaccess or Cloudflare to allow only trusted IPs to access the interface.
Disable redundancy
When XML-RPC is not needed, disable it with a plugin or code (add add_filter(‘xmlrpc_enabled’, ‘__return_false’); to functions.php ), disable system.multicall method to prevent batch attacks.
Security Configuration and Monitoring
Use Wordfence and other security plug-ins for protection, regularly check server logs, and use Fail2Ban to automatically block malicious IPs; account passwords should contain letters, numbers, and special symbols (≥12 digits in length), and do not use the default admin username.
English 
Chinese