xmlrpc and wp-login attacks

[nuffsaid]

Ahoy

I'm getting a log of attacks mainly on the wordpress xmlrpc and wp-login.php files.

Is they a way to configure CSF  to auto block these request as soon as they happen?

Some of these are now overloading the server.

[ejsolutions]

Short answer, yes.
You need a custom regex for CSF - I haven't had the time to fully research this and don't know the syntax enough.
Wordfence helps a bit but doesn't stop the idiots trying.
(You could also setup a honeypot and block them that way)

Untested:
https://www.knownhost.com/wiki/security/csf-lfd/configure-wordpress-using-regex
Might be better:
https://forum.configserver.com/viewtopic.php?t=9447