Protect WordPress from brute-force XML-RPC attacks

...allowed="true" /> </ipSecurity> </security> </system.webServer> </location> Another solution is to block access to xmlrpc.php completely in IIS. In your web.config file add in the appropriate place: <security> <requestFiltering> <denyUrlSequences> <add...