Two WordPress files are routinely abused to generate load and to test passwords at high speed. Both are addressed on our servers, but you should understand why.
WP-CRON.PHP
WordPress triggers its scheduled tasks on visitor page loads. On a busy or bot-hit site this creates thousands of extra PHP requests per hour, and attackers deliberately request the file in a loop to exhaust resources.
HTTP requests to /wp-cron.php are blocked across our fleet. You must set up a real cron job instead, otherwise scheduled posts, auto-updates and backups will silently stop. See the WordPress cron article for the exact steps.
XMLRPC.PHP
This file allows remote applications to connect. It also allows many password attempts to be packed into a single request, making it an efficient brute-force target, and it can be abused for pingback-based attacks.
If you do not use the WordPress mobile app, Jetpack or a remote publishing tool, block it. Add to public_html/.htaccess:
<Files xmlrpc.php>
Require all denied
</Files>Requests are then refused by the web server before PHP runs, which saves resources as well as improving security.
