Enhance Hosting Security For WordPress Sites Automatically With New Block XML-RPC Tool

If offering your clients impregnable hosting security for their WordPress websites without lifting a finger sounds great, you’re going to love Block XML-RPC … our newest weapon against XML-RPC attacks!

WPMU DEV's Block XML-RPC
Block XML-RPC … find out what it means to me!

Since its inception, WordPress has allowed users to interact remotely with their sites using a built-in feature called XML-RPC. This is not only wonderful for smartphone users who want to blog on the go … but hackers too!

In this article, we’ll cover everything you need to know about XML-RPC and show you how to easily and automatically protect WordPress sites hosted with WPMU DEV from hackers exploiting XML-RPC vulnerabilities using our latest hosting security tool.

We’ll also show you how to protect WordPress sites hosted elsewhere.

Read on or click on a link below to skip the basics and get to the good stuff:

The Basics:

The Good Stuff:

Let’s jump right in …

What Is XML-RPC?

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism.

In simple and practical terms, XML-RPC is used for enabling external applications to interact with your WordPress site. This includes actions like posting content, fetching posts, and managing comments remotely, without using the WordPress web interface.

WordPress supports XML-RPC through a file called xmlrpc.php, which can be found in the root directory of every WordPress install. In fact, WordPress support for XML-RPC has been a part of WordPress even before WordPress officially became WordPress.

xmlrpc.php file
The file xmlrpc.php is found in every install of WP.

You can learn more about XML-RPC and WordPress on this post: XML-RPC and Why It’s Time to Remove it for WordPress Security.

What Is XML-RPC Used For?

If you need to access your WordPress website, but you’re nowhere near your computer, XML-RPC facilitates remote content management and integration with third-party applications and streamlines the process of managing WordPress sites without direct access to the admin dashboard.

WordPress users can benefit from using XML-RPC in areas like:

  • Mobile Blogging: Publish posts, edit pages, and upload media files remotely using the WordPress mobile app or other mobile apps.
  • Integration with Desktop Blogging Clients: Applications like Windows Live Writer or MarsEdit allow users to write and publish content from their desktops.
  • Integration with Services: Make connections to services like IFTTT
  • Remote Management Tools: Enable the management of multiple WordPress sites from a single dashboard.
  • Trackbacks and Pingbacks used by other sites to refer to your site.

Despite losing its popularity to newer, more efficient, and more secure APIs built on standards like REST or GraphQL and no longer being supported by PHP from version 8.0 onward, XML-RPC is still widely used in WordPress as it is integrated into many existing systems.

XML-RPC and WordPress Security

If you are using the WordPress mobile app, want to make connections to services like IFTTT, or want to access and publish to your blog remotely, then you need XML-RPC enabled. Otherwise it’s just another portal for hackers to target and exploit.

Pros and Cons of Using XML-RPC

The pros of using XML-RPC are mostly convenience and efficiency.

Though most applications can use the WordPress API instead of XML-RPC, some may still require access to xmlrpc.php and use it to ensure backward compatibility with actively installed older versions.

It’s important, however, to know the cons of using XML-RPC.

Basically, XML-RPC is an outdated protocol with inherent security flaws.

These include:

  • Security Risk: XML-RPC can be exploited for large scale brute force attacks, as it allows unlimited login attempts. Attackers have used XML-RPC functionality to execute widespread brute force attacks against WordPress sites. By leveraging the system.multicall method, attackers can test thousands of password combinations with a single request.
  • Performance: XML-RPC can be a vector for DDoS attacks through the pingback feature, turning unsuspecting WordPress sites into bots against targeted domains, and potentially slowing down or crashing the site.

How to Check if XML-RPC is Enabled/Disabled on WordPress Sites

You can use an XML-RPC validation tool to check whether your WordPress site has XML-RPC enabled or disabled.

WordPress XML-RPC Validation Service tool
A validation tool like xmlrpc.blog lets you easily check whether XML-RPC is enabled on your site.

Enter your URL into the Address field and click the Check button.

If XML-RPC is enabled, you will see a message like the one shown below.

XML-RPC Validation tool.
XML-RPC is enabled for this site.

As explained above, XML-RPC can make WordPress sites vulnerable to spam and cyber attacks.

This is why the best hosting companies block XML-RPC by default and why we recommend you should disable XML-RPC on your WordPress site(s), unless you have applications installed that require it to be enabled.

Let’s take a look, then, at a couple of options you can use to automatically disable XML-RPC on your site (see this post for a manual method that involves adding code to your .htaccess file).

Automate Your Hosting Security with WPMU DEV’s Block XML-RPC Tool

We’ve recently launched a hosting tool called Block XML-RPC that automatically blocks incoming requests on /xmlrpc.php when enabled.

If the tool is disabled, your WordPress site will allow applications access to the /xmlrpc.php file.

Note: New sites hosted on WPMU DEV are created with the Block XML-RPC tool enabled by default.

To access the tool and enable XML-RPC blocking on existing sites, go to The Hub and select the Hosting > Tools tab.

The Hub - Tools - Block XML-RPC
Block XML-RPC improves hosting security … automatically!

Click On/Off to toggle the feature and save your settings when done.

That’s it! Your site is now protected from XML-RPC exploits and attacks at the server level.

Not Hosted with WPMU DEV? We’ve Got You Covered

If your site is not hosted with WPMU DEV (tsk, tsk…), you can use our free Defender security plugin to disable XML-RPC.

The Disable XML-RPC feature is located in the plugin’s Recommendations section.

Defender - Recommendations - Disable XML-RPC
Disable XML-RPC on your site with one click using Defender.

You can check if XML-RPC has been disabled in the Status section.

Defender - Recommendations - Disable XML-RPC
Disabling XML-RPC will make it harder for hackers to exploit your site.

For additional ways to protect your site from DDoS attacks, see this tutorial: How To Protect Your Site From DDoS Attacks.

Note: WordPress plugins only block XML-RPC at the WordPress PHP level, so if an attack occurs, the request will still reach WordPress PHP, subsequently increasing server load.

In contrast, when you enable Block XML-RPC at the server level, the requests will never reach your site and return a “403 Forbidden” error message to the attackers.

XML-RPC Validation tool.
This site is protected at the server level.

For more information and detailed tutorials on the above, see these doc sections: Block XML-RPC tool (Hosting) and Disable XML RPC (Defender plugin).

R-E-S-P-E-C-T XML-RPC

Given the potential security risks, WordPress site owners should carefully consider whether the convenience offered by XML-RPC outweighs its vulnerabilities.

For WordPress sites that benefit from XML-RPC, we recommend implementing strong passwords, limiting login attempts, and using a security plugin like Defender to help mitigate the risks.

However, if the functionality is not needed and your sites run on any of our hosting plans, we strongly recommend disabling XML-RPC at the server level using the XML-RPC tool to further reduce the possibility of DDoS and brute force attacks.

O11y Guide, Cloud-Native Observability Pitfalls: Ignoring Existing Landscape

Are you looking at your organization's efforts to enter or expand into the cloud-native landscape and feeling a bit daunted by the vast expanse of information surrounding cloud-native observability? When you're moving so fast with agile practices across your DevOps, SREs, and platform engineering teams, it's no wonder this can seem a bit confusing.

Unfortunately, the choices being made have a great impact on both your business, your budgets, and the ultimate success of your cloud-native initiatives that hasty decisions upfront lead to big headaches very quickly down the road.

Road to Cloud Maturity

Drawing from my extensive experience over the past several years dedicated to cloud adoption across various applications, it has become apparent that attaining a mature state — often termed the "nirvana" state — is neither immediate nor straightforward. Establishing a well-structured and effectively governed cloud footprint demands thorough planning and early investment. In this article, I aim to share insights and practical tips garnered from firsthand experience to assist in guiding your teams toward proactive preparation for cloud maturity, rather than addressing it as an afterthought.

  1. Establish a comprehensive cloud onboarding framework for all teams and applications to adhere to. This framework will serve as a roadmap, guiding teams in making well-informed architectural decisions, such as selecting appropriate services and SKUs for each environment. Encourage teams to carefully consider networking and security requirements by creating topology diagrams and conducting reviews with a designated cloud onboarding committee. Implement cost forecasting tools to facilitate budget estimation and planning. By adhering to this framework, teams can minimize rework through informed decision-making and prevent unnecessary cost wastage by making early, accurate estimates.
  2. Establish a structured framework for onboarding new services and tools into your cloud environment. Prior to deployment, conduct a comprehensive assessment or a proof of concept to understand the nuances of each service, including networking requirements, security considerations, scalability needs, integration requirements, and other relevant factors like Total Cost of Ownership and so on. By systematically evaluating these aspects, you can ensure that new services are onboarded efficiently, minimizing risks and maximizing their value to the organization. This could be a repeatable framework, providing efficiency and faster time to market.
  3. Make business continuity and disaster recovery a top priority in your cloud strategy. Implement robust plans and processes to ensure high availability and resilience of your cloud infrastructure and applications. Utilize redundant systems, geographic replication, and failover mechanisms to minimize downtime and mitigate the impact of potential disruptions. Regularly test and update your disaster recovery plans to ensure they remain effective in addressing evolving threats and scenarios. By investing in business continuity and disaster recovery measures, you can preserve your cloud operations, prevent data loss, and maintain continuity of services in the face of unforeseen events.     
  4. Implement a controls and policies workstream to ensure adherence to regulatory requirements, industry standards, and internal governance frameworks. This workstream should involve defining and documenting clear controls and policies related to data privacy, security, compliance, and access management. Regular reviews and updates should be conducted to align with evolving regulatory landscapes and organizational needs. By establishing robust controls and policies, you can mitigate risks, enhance data protection, and maintain compliance and governance across your cloud environment.  Some example controls could include ensuring storage is encrypted, implementing TLS for secure communication, and utilizing environment-specific SKUs, such as using smaller SKUs for lower environments.
  5. Invest in DevOps practices by establishing pre-defined environment profiles and promoting repeatability through a DevOps catalog for provisioning and deployment. By standardizing environment configurations and workflows, teams can achieve consistency and reliability across development, testing, and production environments. Implement automated deployment pipelines that enable continuous integration and continuous deployment (CI/CD), ensuring seamless and efficient delivery of software updates. Embrace a CI/CD framework that automates build, test, and deployment processes, allowing teams to deliver value to customers faster and with higher quality. By investing in DevOps practices, you can streamline software delivery, improve collaboration between development and operations teams, and accelerate time-to-market for applications and services.
  6. Promote cost awareness and early cost tracking by establishing or enforcing FinOps principles. Encourage a culture of cost awareness by emphasizing the importance of tracking expenses from day one. Implement robust cost-tracking measures as early as possible in your cloud journey. Utilize automated tools to monitor expenditures continuously and provide regular reports to stakeholders. By instilling a proactive approach to cost management, you can optimize spending, prevent budget overruns, and achieve greater financial efficiency in your cloud operations. Provide guidance through your cloud onboarding framework about cost-aware cloud architecture. To save costs, periodically review resource utilization and seek optimization opportunities such as right-sizing instances, consolidating environments, and leveraging pre-purchasing options like Reserved Instances. 
  7. Regular reviews to assess the current state and future needs for continuous improvement. Establish a practice of periodic reviews to evaluate the current state of your cloud environment and anticipate future needs. Schedule regular assessments to analyze performance, security, scalability, and cost-efficiency. Engage stakeholders from across the organization to gather insights and identify areas for optimization and enhancement. By conducting these reviews systematically, you can stay agile, adapt to changing requirements, and drive continuous improvement in your cloud infrastructure and operations.

These are some considerations that may apply differently depending on the scale or size and the nature of applications or services you use or provide to customers. For personalized advice, share details about your organization's structure and current cloud footprint in the comments below, and I'll be happy to provide recommendations. Thank you for reading!

What Is an SDK? Examples, Use Cases, and Characteristics

SDKs are everywhere, and help developers build software faster and easier. In this article, I take a look at some examples of a few SDKs, and talk through the use cases and characteristics of a good SDK.

What Is a Software Development Kit (SDK)?

We cover this a lot in one of our other articles — how to build an SDK from scratch — but essentially, Software Development Kits (or SDKs) are code libraries containing an abstraction layer that makes it easier to interact with a piece of software or hardware using your preferred programming language, speeding up your application development process.

SAP Commerce Cloud Architecture: All You Need to Know!

Before we get to the point, do you want to transform customer experiences and open agility for your business? Is your company looking for the right architecture to build high-quality online sites? If you have nodded your head to answer, ‘YES!”, then we have the solution. It is called SAP Commerce Cloud Architecture. SAP Commerce Cloud is one of the most proficient e-commerce platforms for business. 

Not to mention! 

How to Add Instagram-like Photo Filters in WordPress (Step by Step)

Do you want to add photo filters like Instagram in WordPress?

If you like to edit your photos using Instagram filters, then you may want to know how to create a similar effect for the images on your WordPress site. This can help your content stand out.

In this article, we will cover how to add Instagram-like photo filters in WordPress.

Add Instagram like photo filters in WordPress

Why Add Instagram-Like Photo Filters in WordPress?

An Instagram filter is a feature in the social media platform that lets you edit your photo with a single click. You simply choose from a library of pre-set edits for the image, and Instagram automatically applies those changes.

For each photo, you can choose how much of the filter you want to apply to the photo, ranging from 0 to 100%.

Instagram filters

So why should you use Instagram filters? Here are a few key reasons:

  • Edit your photos more easily and quickly: We all want to post beautiful images on our WordPress sites. Unless your photos are already stunning or you are a master of Adobe Photoshop, you probably want an easier way to retouch your photos.
  • Create a consistent brand image: Branding is everything. It tells a story about the type of company you are and the message you want to send to your audience. Using on-brand filters will increase your website’s visual appeal and create a more cohesive look.
  • Get creative: Filters can add variety to your content, allowing you to make images stand out. This can be helpful for showcasing products or portfolio items.

Note: If you want to learn how to make other changes to your images, then check out our post on how to do basic image editing in WordPress.

That being said, let’s go over how to add Instagram-like photo filters to your WordPress site.

How to Add Instagram Photo Effects With Easy Image Filters

The good news is that you can add image filters in WordPress for free. You don’t need to go through the hassle of using a separate platform like Instagram or photo-editing software to do it.

To get started, you need to install and activate the Easy Image Filters plugin.

Easy Image Filters

If you need step-by-step instructions, then just check out our guide on how to install a WordPress plugin.

Once activated, go ahead and upload the photos you’d like to edit to your WordPress Media library.

To do so, head over to Media » Add New Media File. From there, choose the image files you want to add and select ‘Upload.’

upload media files

Now, simply upload all the photos you’d like to add filters to.

Next, you must head over to the Media » Library tab and then select the photo you want to edit.

Select photo in media library

The attachment details of the image should open up, where you’ll see a full preview of the photo.

In the bottom right corner, go ahead and click on ‘Edit more details.’

Edit more details

Under the Description field, you’ll see the ‘Add Image effects’ feature, where you can apply various filters to your selected image.

Click on ‘Add.’

Add image filter

In this screen, you will see the image on the top of the screen, followed by available adjustments and presets you can make.

Some of the important adjustments you can make are changes to the photo include:

  • Brightness
  • Contrast
  • Vibrance
  • Saturation
  • Exposure
  • Hue
  • And more

You are also given 25 different presets to choose from. A preset is a configuration of settings designed to achieve a certain look. It automatically adjusts certain colors and lighting in the photo so you don’t need to do it manually.

Adjustments and presets

Go ahead and toggle the adjustments, or select any preset that fits your preference.

Once you are happy with the filter enhancements, click on ‘Save.’ Or, if you’d like to revert the image to its original state, you can select ‘Reset’ instead.

Save filter enhancements

Once you’ve saved your edits, the updated image will automatically appear in your Media library.

Just head back to the Media » Library tab, and you will find the updated image with the Instagram-like filter added.

Image with Instagram-like filter in WordPress

Now, you are able to upload that photo anywhere on your site.

For example, you can add the image to a WordPress page or post and it should look like this.

Adding filtered image to wordpress

If you need help uploading your filtered images, you can check out our guide on how to properly add images in WordPress.

Adding photo effects to your images is a great way to make them stand out. But in some cases, you might want also to add your filtered pictures to an image gallery.

Here are a few examples where this might be useful:

  • You are a photographer and want to showcase your portfolio.
  • You run a real estate company and are looking to highlight photos of your residential homes.
  • You are a digital agency that wants to show potential clients a preview of the type of work you can do.

But galleries are not limited to these businesses either. Almost any website could use an image gallery to visually showcase their products or services.

To create an image gallery for your filtered photos, you will need to install and activate the Envira Gallery plugin.

Note: You can simply use the free version of Envira Gallery if you are only interested in adding image sliders. But if you want advanced features like more gallery themes, lightboxes, or video sliders, then you should consider using the pro version.

Envira Gallery is the best image gallery plugin for WordPress. It allows you to create beautiful mobile responsive photo and video galleries using its drag-and-drop builder.

Is Envira Gallery the right photo and video gallery plugin for you?

The first thing you’ll need to do is install and activate the Envira Gallery plugin. If you need step-by-step instructions, check out our guide on how to install a WordPress plugin.

Upon activation, you’ll need to go to the Envira Gallery » Add New page to create a new gallery. Give it a title so you can easily refer to it later.

Then click on ‘Select Files from Your Computer.’

Upload images to Envira Gallery

Then, you need to choose the images from your computer.

Once the photos are uploaded, you can scroll down to see all the images added in the ‘Gallery’ tab.

images added to gallery

In the ‘Configurations’ tab, you can choose the gallery layout, image size, image dimensions, and more.

That way you can customize the gallery appearance to fit your needs.

Configurations tab

From there, just hit the ‘Publish’ button in the right-side panel.

You can then use the Envira Gallery block to add your gallery to any post or page.

publish envira gallery

Here’s what it looks like on our demo website.

For more details, just check out our guide on how to create an image gallery in WordPress.

Gallery example

We hope you found this article helped you learn how to add Instagram-like photo filters in WordPress. You may want to check out our expert picks of the best social media plugins for WordPress or our guide on the proven ways to make money online blogging.

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.

The post How to Add Instagram-like Photo Filters in WordPress (Step by Step) first appeared on WPBeginner.

Dysfunction Mapping

In this fascinating talk, Michael Lloyd introduced the concept of dysfunction mapping, a tool developed over years of trial and error aimed at creating a repeatable way to find, theme, and ultimately solve organizational dysfunction.

Abstract

Dysfunction mapping is a tool developed over years of trial and error, aimed at creating a repeatable way to find, theme, and ultimately, solve organizational dysfunction. By following these steps, you can more quickly identify the biggest wins, develop a solid action plan, and measure if you’re really achieving outcomes that matter. It’s not a silver bullet, but it can give you some structure to creatively solve problems while also making your value visible and your goals clear.

Why Apache Kafka and Apache Flink Work Well Together to Boost Real-Time Data Analytics

When data is analyzed and processed in real time, it can yield insights and actionable information either instantly or with very little delay from the time the data is collected. The capacity to collect, handle, and retain user-generated data in real time is crucial for many applications in today’s data-driven environment. 

There are various ways to emphasize the significance of real-time data analytics like timely decision-making, IoT and sensor data processing, enhanced customer experience, proactive problem resolution, fraud detection and security, etc. Rising to the demands of diverse real-time data processing scenarios, Apache Kafka has established itself as a dependable and scalable event streaming platform. 

Overcoming the Art Challenges of Staying Ahead in Software Development

Software development is a rapidly converting industry with new technology and traits rising yearly. As a software developer, it's vital to live ahead of the game to stay competitive in the area. This may be a daunting task because the pace of change can be overwhelming. 

However, some positive strategies and recommendations let you stay ahead of the curve. In this article, we will reveal some of the mysteries and techniques to overcoming the artwork challenges of staying in advance in software development. From networking and continuous studying to embracing new technologies and constructing a sturdy foundation inside the basics, study on to discover the keys to staying in advance in this thrilling and ever-evolving enterprise.

How Next-Generation GPUs Are Shaping Immersive Experiences

One of the most exciting aspects of next-generation GPUs is their ability to render incredibly detailed and lifelike graphics in real time. This advancement is a game-changer for industries like virtual reality (VR), augmented reality (AR), and gaming, where the demand for more immersive experiences continues to grow. These new GPUs don't just offer better visuals; they also provide improvements in energy efficiency, computing power, and AI integration, making them more versatile and sustainable. 

As computing technology continues to evolve, it's evident that next-gen GPUs are more than hardware components. They enable innovation by pushing the boundaries of what's possible in GPU technology. In this article, we will explore how next-generation GPUs are shaping immersive experiences.

SSD vs. HDD: How the Choice of Storage Affects Developer Workflows

Having the right tools makes a big difference in any job. Software development is no different, where your computer’s performance can significantly help or hinder your efficiency at work. While there are many hardware factors to consider, one of the most important is choosing the right kind of storage.

Hard disk drives (HDDs) and solid-state drives (SSDs) each have unique strengths and weaknesses. As a developer, you should carefully weigh these factors to determine which is best for your workflow.

The Best Way To Diagnose a Patient Is To Cut Him Open

"The most effective debugging tool is still careful thought, coupled with judiciously placed print statements." — Brian Kernighan.

Cutting a patient open and using print for debugging used to be the best way to diagnose problems. If you still advocate either one of those as the superior approach to troubleshooting, then you're either facing a very niche problem or need to update your knowledge. This is a frequent occurrence, e.g., this recent tweet:

Demystifying Data Integration: A Comprehensive Guide

In a data-driven world, data integration has become a cornerstone for businesses to acquire, combine, manage, and interpret data efficiently. This blog post delves into the foundational concepts surrounding data integration, analyzing its role, key methodologies, innovative strategies, and how to effectively manage its process. We will also evaluate the pros and cons of real-time and batch integration and explore prevailing trends shaping the future of data integration. Neophytes and zealous professionals alike can derive enlightenment from this walkthrough. 

Introduction: Understanding Data Integration

The colossal growth of data has transformed the business landscape, and data integration is at the heart of this transformation. As data-centered methods have become the norm in every industry, understanding what data integration is, why it matters, and its key facets is invaluable for every business.

Hybrid Cloud Backup: A Comprehensive Guide To Securing Your Data

The era of digital transformation has ushered in a new dimension of data management challenges, with businesses of all sizes grappling with how to safeguard their critical data assets. Amid this backdrop, hybrid cloud backup has emerged as a pivotal solution, blending the reliability of traditional backup methods with the scalability and efficiency of cloud technology. This guide offers a deep dive into the nuances of hybrid cloud backup, exploring its benefits, operational mechanisms, and strategic implementation tips to fortify your data protection strategy.

The Essence of Hybrid Cloud Backup

What Is Hybrid Cloud Backup?

Hybrid cloud backup represents a strategic amalgamation of on-premises and cloud-based backup solutions designed to offer businesses a comprehensive, scalable, and secure data protection framework. This approach not only enhances data accessibility and recovery but also fortifies data security against evolving threats.

Navigating the Complexities of Text Summarization With NLP

In today's world, we are bombarded with a vast amount of information, much of which is in the form of text. To make sense of this data, it's important to be able to extract the most important information quickly and efficiently. Natural Language Processing (NLP) provides a range of techniques for text summarization, allowing users to identify the key insights and make informed decisions. However, implementing these techniques is not always straightforward. This article takes a detailed look at text summarization, including the challenges posed by issues such as data privacy and ethics in web scraping, as well as the practicalities of deploying these methods in real-world scenarios.

1. Extractive Summarization: Let's Look at the Core Elements

Extractive summarization is a technique used in text summarization that involves identifying and condensing important sentences or phrases from the original text. This method is simple and transparent, making it ideal for situations where maintaining the original wording is essential.