On October 12, I closed pingbacks on Mad Tea Party. Technically, it wasn’t pingbacks that started it. It was XML-RPC. During the routine check on Cloudflare, the AI noticed an address posting to /xmlrpc.php about every ten seconds. I assumed the usual botnet scanning for WordPress installations, and wasn’t expecting anything as dramatic as what turned up.

What the AI found in the logs still retained was alarming: XML-RPC drew 56,542 POSTs from 369 addresses, and the login page another 6,909 from 1,257. There was no sign of a successful login. All accounts use 2FA. No real traffic was using XML-RPC either. The last pingback arrived in 2023.

My old host’s CDN restricted XML-RPC and capped login attempts, and both left when the site moved behind Cloudflare in August. Cloudflare had no rule in their place for eight weeks. But I only learned that protection existed after the fact; it was never communicated to me. I can’t say how well it worked, and I don’t know why the host restricted XML-RPC instead of simply blocking it. This is the same host that installed SEO and cache plugins on my site without my authorization.

With pingbacks and trackbacks, unlike when I disabled comments, I wanted to keep the conversation open. The AI’s knee-jerk response to the possible brute-force attack was to either completely disable XML-RPC or, as a compromise, use Cloudflare’s own rate limit to stop the illegitimate traffic. It didn’t take long for me to figure out the interval of these calls was “coincidentally” matching what Cloudflare offers on a free tier. The real answer came when I read about a potential vulnerability in pingbacks. I asked the AI if the info was true, and it was: in 2014, pingbacks turned more than 162,000 WordPress sites on a single target. The AI also found that accepting a pingback leaks my Linux box’s real IP address to any stranger who asks. After I decided I wouldn’t be receiving pingbacks, I saw no point in sending any, so it was disabled, completely.

There is a successor to pingbacks called Webmention, which WordPress would receive through its REST API. But stock WordPress still sends only pingbacks, and receiving Webmentions takes a plugin, a public endpoint anyone can post to, a theme change, and new policy text, all for a channel last used here in 2023. The plugin also has the IP exposure issue. Trackbacks are staying open: WordPress fetches nothing to verify one, though none has ever arrived. As far as I’m aware, trackbacks are even less popular than pingbacks ever were.

Had I found this myself, it would have become a project of its own: researching the options, weighing them, and setting the actual vulnerabilities against the benefits of keeping a legacy protocol. Instead the AI read the logs, came back with a plan before touching anything, and answered my questions about each protocol. I made the calls and signed in to Cloudflare when asked; it entered the rules, and the server changes ran behind recovery points. XML-RPC closed that day, the login page went behind a Cloudflare challenge, and earlier pingbacks stay published.

A hosting service once covered part of this without a word, perhaps as a common security practice. This time I know what is closed and why, and I was able to decide and act on it on the same day. That’s what the home box and the AI add. Random housekeeping items don’t escalate into a project spanning several weekends.