How to Disable WordPress Pingback to Prevent Pingback Brute Force and DDoS Attacks?

WordPress uses an XML-RPC interface which allows users to post to a WordPress website through popular Weblog clients. WordPress supports the Blogger API, MetaWeblog API, Movable Type API, and the Pingback API. This functionality can be further extended by WordPress plugins. WordPress XML-RPC also allows attackers to exploit WordPress website so that exploited WordPress websites can be used as a platform to launch attacks through pingback exploits.

What is Pingback and How it Works?

The Pingback is a built-in linkback functionality that can be used to receive notification when someone links to your blog posts. When you enable the pingback in your WordPress website and you post a content that links to another website, an XML-RPC request is sent to other website which will automatically pingback to the source website to verify whether the incoming link is live or not. The whole process will go like following:

• We have published a post to our blog.
• You publish a post on your blog with link to one of our blog.
• Your blogging platform will automatically send us a pingback.
• Our blogging platform will receive the pingback. Now, it will automatically go to your blog to verify that the link is present there.
• Now, we can display your pingback as comment to our blog. This will be a link to your website.

Why should we disable pingbacks?

A WordPress website with Pingback enabled can be used in DDOS attacks against other websites. An attacker can exploit pingback functionality through simple command and an XML-RPC request. Thus, thousands of legitimate WordPress websites can be exploited to launch a large scale DDoS attack.

Nowadays, attackers are using XML-RPC vulnerabilities and XML-RPC wp.getUsersBlogs function to generate large-scale brute force attacks against WordPress sites. WordPress XML-RPC requires a username and password, so attackers are now using a method like wp.getUsersBlogs to guess big number of passwords and possibly gain access to WordPress admin accounts. Rather conducting brute-force on wp-admin page, attackers have now begun to utilize XML-RPC which is the fastest method to generate brute-force and harder to detect as well.

Securing your WordPress website against DDoS/Brute-Force attacks

WordPress version 3.9.2 was released with the fix that reduced the impact of some DDoS attacks, but, if pingback and XML-RPC are still enabled in your WordPress website, your websites can be exploited. To protect your WordPress website against such attacks, disable pingback and XML-RPC entirely. You can install XML-RPC Pingback WordPress plugin to disable the pingbacks in WordPress website.