Blocking XML-RPC Attacks on WordPress Portfolios with Nginx

Protecting Your WordPress Portfolio from Hidden Server Overloads

I recently had a frantic call from an agency owner. Every time they posted a new project to their portfolio, their server would crawl to a halt and crash. They thought they were getting massive traffic from potential clients. They were excited, but when I looked at the raw server logs, the reality was much less glamorous.

They were being hit by a massive XML-RPC brute-force attack. Bots were hammering their site to guess login credentials, draining their server memory until everything fell over.

If you run a creative portfolio, you don't need a fancy or expensive hosting setup to stop this. Here is exactly how I secured their site in ten minutes.

Step 1: Kill XML-RPC at the Server Level

Most modern WordPress sites do not need XML-RPC. It is an old feature used to connect external blogging apps. If you are not writing posts from your phone with the old mobile app, you should turn it off.

Don't use a plugin for this task. Plugins load after WordPress boots up. This means your server still has to process the PHP request before blocking it, which wastes CPU power. Instead, block it directly in your Nginx configuration:

# Block XML-RPC access
location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

With this small Nginx rule, the server drops the bad requests instantly without touching PHP. This saves a massive amount of memory.

Step 2: Restrict the REST API to Logged-In Users

Another common issue is content scraping. Bots love to hit /wp-json/wp/v2/posts to steal your portfolio images and text. This puts a heavy, unnecessary load on your database.

If you do not need your content public via API, you should restrict access to logged-in users only. Put this snippet in your child theme's functions.php file:

add_filter('rest_authentication_errors', function($result) {
    if (!empty($result)) {
        return $result;
    }
    if (!is_user_logged_in()) {
        return new WP_Error('rest_not_logged_in', 'Access Denied', array('status' => 401));
    }
    return $result;
});

Now, if a bot tries to scrape your site, the server tells them to go away without running heavy database queries.

Step 3: Keep Your Code Clean

Many heavy themes use custom endpoints and bloated JavaScript frameworks that open up extra security holes. If you are starting fresh, look for a lightweight template built on standard core functions.

The Creaox - Creative Agency Portfolio WordPress Theme is a solid choice because it relies on standard block building and native WordPress asset loading. It doesn't bundle dozens of outdated plugins that slow down your response time or leave you open to security threats.

The Outcome

After blocking XML-RPC and restricting the REST API, the agency's server load dropped by 80%. When they launched their next campaign, the site stayed up and fast.

Securing your portfolio doesn't require complex tools. A few simple blocks at the server level are often all you need to keep your work safe and your pages fast.