{"id":118869,"date":"2025-09-02T13:41:56","date_gmt":"2025-09-02T06:41:56","guid":{"rendered":"https:\/\/tino.vn\/blog\/?p=118869"},"modified":"2025-09-02T13:42:41","modified_gmt":"2025-09-02T06:42:41","slug":"xmlrpc-php-trong-wordpress-la-gi","status":"publish","type":"post","link":"https:\/\/tino.vn\/blog\/xmlrpc-php-trong-wordpress-la-gi\/","title":{"rendered":"xmlrpc.php WordPress l\u00e0 g\u00ec? H\u01b0\u1edbng d\u1eabn t\u1eaft xmlrpc.php \u0111\u1ec3 b\u1ea3o m\u1eadt website"},"content":{"rendered":"\n<p><strong>B\u1ea1n c\u00f3 bao gi\u1edd t\u1ef1 h\u1ecfi t\u1ea1i sao website<a href=\"https:\/\/tino.vn\/blog\/wordpress-la-gi\/\" target=\"_blank\" data-type=\"post\" data-id=\"15589\" rel=\"noreferrer noopener\"> WordPress<\/a> c\u1ee7a m\u00ecnh ho\u1ea1t \u0111\u1ed9ng ch\u1eadm ho\u1eb7c d\u1ec5 b\u1ecb t\u1ea5n c\u00f4ng? M\u1ed9t trong nh\u1eefng nguy\u00ean nh\u00e2n c\u00f3 th\u1ec3 \u0111\u1ebfn t\u1eeb xmlrpc.php \u2013 m\u1ed9t t\u00ednh n\u0103ng h\u1ed7 tr\u1ee3 k\u1ebft n\u1ed1i t\u1eeb xa nh\u01b0ng c\u0169ng l\u00e0 c\u00e1nh c\u1eeda \u0111\u1ec3 hacker t\u1ea5n c\u00f4ng. V\u1eady xmlrpc.php trong WordPress l\u00e0 g\u00ec? H\u00e3y c\u00f9ng Tino t\u00ecm hi\u1ec3u ngay qua b\u00e0i vi\u1ebft d\u01b0\u1edbi \u0111\u00e2y b\u1ea1n nh\u00e9!<\/strong><\/p>\n\n\n\n<h2 id=\"xmlrpc.php_trong_WordPress_l\u00e0_g\u00ec?\"><a id=\"post-118869-_ipln58nd6cs7\"><\/a>xmlrpc.php trong WordPress l\u00e0 g\u00ec?<\/h2>\n\n\n\n<p>xmlrpc.php l\u00e0 m\u1ed9t t\u1ec7p trong WordPress cho ph\u00e9p website c\u1ee7a b\u1ea1n k\u1ebft n\u1ed1i v\u00e0 giao ti\u1ebfp t\u1eeb xa v\u1edbi c\u00e1c \u1ee9ng d\u1ee5ng b\u00ean ngo\u00e0i. Th\u00f4ng th\u01b0\u1eddng, t\u1ec7p n\u00e0y s\u1ebd \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 g\u1eedi v\u00e0 nh\u1eadn d\u1eef li\u1ec7u gi\u1eefa WordPress c\u0169ng nh\u01b0 c\u00e1c n\u1ec1n t\u1ea3ng kh\u00e1c, nh\u01b0 \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng, ph\u1ea7n m\u1ec1m vi\u1ebft blog t\u1eeb xa (nh\u01b0 Open Live Writer) ho\u1eb7c c\u00e1c d\u1ecbch v\u1ee5 t\u1ef1 \u0111\u1ed9ng h\u00f3a.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" width=\"700\" height=\"400\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-2.png\" alt=\"xmlrpc.php trong WordPress l\u00e0 g\u00ec?\" class=\"wp-image-118871\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-2.png 700w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-2-300x171.png 300w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><figcaption class=\"wp-element-caption\"><strong>xmlrpc.php trong WordPress l\u00e0 g\u00ec?<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>Tr\u01b0\u1edbc khi REST API ra \u0111\u1eddi, xmlrpc.php l\u00e0 gi\u1ea3i ph\u00e1p ch\u00ednh gi\u00fap WordPress c\u00f3 th\u1ec3 ho\u1ea1t \u0111\u1ed9ng v\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng b\u00ean ngo\u00e0i. Tuy nhi\u00ean, do c\u00f3 nhi\u1ec1u l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt, xmlrpc.php c\u0169ng l\u00e0 m\u1ee5c ti\u00eau ph\u1ed5 bi\u1ebfn c\u1ee7a hacker \u0111\u1ec3 <a href=\"https:\/\/tino.vn\/blog\/ddos-la-gi\/\" target=\"_blank\" data-type=\"post\" data-id=\"265\" rel=\"noreferrer noopener\">t\u1ea5n c\u00f4ng DDoS<\/a>, Brute Force v\u00e0 c\u00e1c h\u00ecnh th\u1ee9c x\u00e2m nh\u1eadp kh\u00e1c. V\u00ec v\u1eady, nhi\u1ec1u qu\u1ea3n tr\u1ecb vi\u00ean website th\u01b0\u1eddng v\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php \u0111\u1ec3 t\u0103ng c\u01b0\u1eddng b\u1ea3o m\u1eadt.<\/p>\n\n\n\n<h2 id=\"M\u1ee5c_\u0111\u00edch_s\u1eed_d\u1ee5ng_c\u1ee7a_xmlrpc.php_trong_WordPress\"><a id=\"post-118869-_ge10knyhi3bt\"><\/a>M\u1ee5c \u0111\u00edch s\u1eed d\u1ee5ng c\u1ee7a xmlrpc.php trong WordPress<\/h2>\n\n\n\n<p>xmlrpc.php l\u00e0 m\u1ed9t giao th\u1ee9c \u0111\u01b0\u1ee3c ph\u00e1t tri\u1ec3n t\u1eeb nh\u1eefng n\u0103m 1998, cho ph\u00e9p truy\u1ec1n d\u1eef li\u1ec7u gi\u1eefa c\u00e1c h\u1ec7 th\u1ed1ng kh\u00e1c nhau th\u00f4ng qua m\u1ea1ng Internet.<\/p>\n\n\n\n<p>Khi WordPress ra \u0111\u1eddi v\u00e0o n\u0103m 2003, xmlrpc.php \u0111\u00e3 \u0111\u01b0\u1ee3c t\u00edch h\u1ee3p \u0111\u1ec3 gi\u00fap website c\u00f3 th\u1ec3 k\u1ebft n\u1ed1i v\u1edbi c\u00e1c d\u1ecbch v\u1ee5 b\u00ean ngo\u00e0i, nh\u1ea5t l\u00e0 trong b\u1ed1i c\u1ea3nh Internet l\u00fac \u0111\u00f3 ch\u01b0a c\u00f3 c\u00e1c API hi\u1ec7n \u0111\u1ea1i nh\u01b0 ng\u00e0y nay. Nh\u1edd xmlrpc.php, ng\u01b0\u1eddi d\u00f9ng c\u00f3 th\u1ec3:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Vi\u1ebft v\u00e0 \u0111\u0103ng b\u00e0i t\u1eeb xa th\u00f4ng qua c\u00e1c \u1ee9ng d\u1ee5ng blog nh\u01b0 Open Live Writer ho\u1eb7c ph\u1ea7n m\u1ec1m qu\u1ea3n l\u00fd n\u1ed9i dung.<\/li>\n\n\n\n<li>K\u1ebft n\u1ed1i WordPress v\u1edbi \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng \u0111\u1ec3 qu\u1ea3n l\u00fd b\u00e0i vi\u1ebft, nh\u1eadn th\u00f4ng b\u00e1o v\u00e0 c\u1eadp nh\u1eadt n\u1ed9i dung.<\/li>\n\n\n\n<li>\u0110\u1ed3ng b\u1ed9 h\u00f3a d\u1eef li\u1ec7u v\u1edbi c\u00e1c n\u1ec1n t\u1ea3ng kh\u00e1c nh\u01b0 h\u1ec7 th\u1ed1ng CRM, c\u00f4ng c\u1ee5 t\u1ef1 \u0111\u1ed9ng h\u00f3a ho\u1eb7c m\u1ea1ng x\u00e3 h\u1ed9i.<\/li>\n<\/ul>\n\n\n\n<p>Tuy nhi\u00ean, v\u1edbi s\u1ef1 ra \u0111\u1eddi c\u1ee7a REST API trong c\u00e1c phi\u00ean b\u1ea3n WordPress hi\u1ec7n \u0111\u1ea1i, xmlrpc.php d\u1ea7n tr\u1edf n\u00ean l\u1ed7i th\u1eddi v\u00e0 kh\u00f4ng c\u00f2n l\u00e0 ph\u01b0\u01a1ng th\u1ee9c k\u1ebft n\u1ed1i t\u1ed1i \u01b0u. Thay v\u00e0o \u0111\u00f3, REST API mang \u0111\u1ebfn nhi\u1ec1u c\u1ea3i ti\u1ebfn v\u1ec1 t\u1ed1c \u0111\u1ed9, t\u00ednh linh ho\u1ea1t v\u00e0 \u0111\u1eb7c bi\u1ec7t l\u00e0 b\u1ea3o m\u1eadt t\u1ed1t h\u01a1n. V\u00ec v\u1eady, ng\u00e0y nay, nhi\u1ec1u qu\u1ea3n tr\u1ecb vi\u00ean website \u0111\u00e3 l\u1ef1a ch\u1ecdn v\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php \u0111\u1ec3 tr\u00e1nh c\u00e1c r\u1ee7i ro b\u1ea3o m\u1eadt ti\u1ec1m \u1ea9n.<\/p>\n\n\n\n<h2 id=\"Nguy\u00ean_l\u00fd_ho\u1ea1t_\u0111\u1ed9ng_c\u1ee7a_xmlrpc.php\"><a id=\"post-118869-_smglriubk4qx\"><\/a>Nguy\u00ean l\u00fd ho\u1ea1t \u0111\u1ed9ng c\u1ee7a xmlrpc.php<\/h2>\n\n\n\n<p>\u0110\u1ec3 hi\u1ec3u c\u00e1ch ho\u1ea1t \u0111\u1ed9ng, b\u1ea1n h\u00e3y t\u01b0\u1edfng t\u01b0\u1ee3ng xmlrpc.php nh\u01b0 m\u1ed9t &#8220;c\u1ea7u n\u1ed1i&#8221; gi\u00fap website WordPress giao ti\u1ebfp v\u1edbi c\u00e1c \u1ee9ng d\u1ee5ng b\u00ean ngo\u00e0i. Khi m\u1ed9t \u1ee9ng d\u1ee5ng ho\u1eb7c d\u1ecbch v\u1ee5 mu\u1ed1n k\u1ebft n\u1ed1i v\u1edbi WordPress, n\u00f3 s\u1ebd g\u1eedi<strong> y\u00eau c\u1ea7u (request) <\/strong>\u0111\u1ebfn xmlrpc.php, sau \u0111\u00f3 WordPress s\u1ebd x\u1eed l\u00fd v\u00e0 g\u1eedi l\u1ea1i <strong>ph\u1ea3n h\u1ed3i (response) <\/strong>ph\u00f9 h\u1ee3p.<\/p>\n\n\n\n<p>C\u1ee5 th\u1ec3, xmlrpc.php ho\u1ea1t \u0111\u1ed9ng theo nguy\u00ean l\u00fd sau:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u1ee8ng d\u1ee5ng b\u00ean ngo\u00e0i g\u1eedi y\u00eau c\u1ea7u XML-RPC<\/li>\n\n\n\n<li>Y\u00eau c\u1ea7u n\u00e0y ch\u1ee9a c\u00e1c l\u1ec7nh \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a b\u1eb1ng ng\u00f4n ng\u1eef XML v\u00e0 g\u1eedi \u0111\u1ebfn t\u1ec7p xmlrpc.php th\u00f4ng qua giao th\u1ee9c HTTP.<\/li>\n\n\n\n<li>V\u00ed d\u1ee5: M\u1ed9t \u1ee9ng d\u1ee5ng vi\u1ebft blog t\u1eeb xa c\u00f3 th\u1ec3 g\u1eedi y\u00eau c\u1ea7u &#8220;\u0110\u0103ng b\u00e0i m\u1edbi&#8221; l\u00ean website WordPress c\u1ee7a b\u1ea1n.<\/li>\n\n\n\n<li>xmlrpc.php x\u1eed l\u00fd y\u00eau c\u1ea7u v\u00e0 chuy\u1ec3n ti\u1ebfp \u0111\u1ebfn WordPress<\/li>\n\n\n\n<li>Khi nh\u1eadn \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u, xmlrpc.php s\u1ebd gi\u1ea3i m\u00e3 d\u1eef li\u1ec7u XML v\u00e0 ki\u1ec3m tra th\u00f4ng tin x\u00e1c th\u1ef1c (t\u00ean \u0111\u0103ng nh\u1eadp, m\u1eadt kh\u1ea9u).<\/li>\n\n\n\n<li>N\u1ebfu h\u1ee3p l\u1ec7, n\u00f3 s\u1ebd chuy\u1ec3n l\u1ec7nh \u0111\u1ebfn WordPress Core \u0111\u1ec3 th\u1ef1c hi\u1ec7n t\u00e1c v\u1ee5 mong mu\u1ed1n.<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" width=\"700\" height=\"400\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-3.png\" alt=\"Nguy\u00ean l\u00fd ho\u1ea1t \u0111\u1ed9ng c\u1ee7a xmlrpc.php\" class=\"wp-image-118872\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-3.png 700w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-3-300x171.png 300w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><figcaption class=\"wp-element-caption\"><strong>Nguy\u00ean l\u00fd ho\u1ea1t \u0111\u1ed9ng c\u1ee7a xmlrpc.php<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress ph\u1ea3n h\u1ed3i l\u1ea1i k\u1ebft qu\u1ea3<\/li>\n\n\n\n<li>Sau khi x\u1eed l\u00fd xong, WordPress s\u1ebd t\u1ea1o m\u1ed9t ph\u1ea3n h\u1ed3i d\u1ea1ng XML v\u00e0 g\u1eedi l\u1ea1i cho \u1ee9ng d\u1ee5ng y\u00eau c\u1ea7u ban \u0111\u1ea7u.<\/li>\n\n\n\n<li>N\u1ebfu th\u00e0nh c\u00f4ng, ph\u1ea3n h\u1ed3i c\u00f3 th\u1ec3 ch\u1ee9a ID b\u00e0i vi\u1ebft m\u1edbi ho\u1eb7c th\u00f4ng b\u00e1o &#8220;\u0110\u0103ng b\u00e0i th\u00e0nh c\u00f4ng&#8221;. N\u1ebfu c\u00f3 l\u1ed7i, ph\u1ea3n h\u1ed3i s\u1ebd m\u00f4 t\u1ea3 l\u1ed7i \u0111\u00f3.<\/li>\n<\/ul>\n\n\n\n<p><em>V\u00ed d\u1ee5 v\u1ec1 ho\u1ea1t \u0111\u1ed9ng c\u1ee7a xmlrpc.php<\/em><\/p>\n\n\n\n<p>Gi\u1ea3 s\u1eed b\u1ea1n \u0111ang s\u1eed d\u1ee5ng \u1ee9ng d\u1ee5ng WordPress Mobile App \u0111\u1ec3 \u0111\u0103ng b\u00e0i t\u1eeb xa, khi b\u1ea1n nh\u1ea5n <strong>&#8220;Xu\u1ea5t b\u1ea3n&#8221;<\/strong>, \u1ee9ng d\u1ee5ng s\u1ebd g\u1eedi y\u00eau c\u1ea7u \u0111\u1ebfn xmlrpc.php. T\u1ec7p n\u00e0y s\u1ebd x\u00e1c th\u1ef1c t\u00e0i kho\u1ea3n c\u1ee7a b\u1ea1n, ki\u1ec3m tra n\u1ed9i dung v\u00e0 n\u1ebfu h\u1ee3p l\u1ec7, b\u00e0i vi\u1ebft s\u1ebd \u0111\u01b0\u1ee3c xu\u1ea5t b\u1ea3n tr\u00ean website.<\/p>\n\n\n\n<h2 id=\"Ch\u1ee9c_n\u0103ng_c\u1ee7a_xmlrpc.php_trong_WordPress\"><a id=\"post-118869-_elbtuqvgwu4\"><\/a>Ch\u1ee9c n\u0103ng c\u1ee7a xmlrpc.php trong WordPress<\/h2>\n\n\n\n<h3 id=\"1._K\u1ebft_n\u1ed1i_WordPress_v\u1edbi_c\u00e1c_\u1ee9ng_d\u1ee5ng_b\u00ean_ngo\u00e0i\"><a id=\"post-118869-_a3b2xgqrhx6\"><\/a><strong>1. K\u1ebft n\u1ed1i WordPress v\u1edbi c\u00e1c \u1ee9ng d\u1ee5ng b\u00ean ngo\u00e0i<\/strong><\/h3>\n\n\n\n<p>M\u1ed9t trong nh\u1eefng ch\u1ee9c n\u0103ng quan tr\u1ecdng nh\u1ea5t c\u1ee7a xmlrpc.php l\u00e0 gi\u00fap WordPress k\u1ebft n\u1ed1i v\u1edbi c\u00e1c \u1ee9ng d\u1ee5ng b\u00ean ngo\u00e0i, nh\u1ea5t l\u00e0 trong th\u1eddi k\u1ef3 m\u00e0 API hi\u1ec7n \u0111\u1ea1i ch\u01b0a ph\u1ed5 bi\u1ebfn. T\u1ec7p n\u00e0y cho ph\u00e9p c\u00e1c ph\u1ea7n m\u1ec1m vi\u1ebft blog t\u1eeb xa, \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng ho\u1eb7c h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd n\u1ed9i dung (CMS) kh\u00e1c g\u1eedi y\u00eau c\u1ea7u \u0111\u1ebfn WordPress \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c thao t\u00e1c nh\u01b0 \u0111\u0103ng b\u00e0i, c\u1eadp nh\u1eadt d\u1eef li\u1ec7u ho\u1eb7c truy xu\u1ea5t th\u00f4ng tin.<\/p>\n\n\n\n<p>Nh\u1edd xmlrpc.php, ng\u01b0\u1eddi d\u00f9ng c\u00f3 th\u1ec3 qu\u1ea3n l\u00fd website WordPress m\u00e0 kh\u00f4ng c\u1ea7n \u0111\u0103ng nh\u1eadp tr\u1ef1c ti\u1ebfp v\u00e0o giao di\u1ec7n qu\u1ea3n tr\u1ecb. Tuy nhi\u00ean, do c\u00f3 th\u1ec3 b\u1ecb hacker khai th\u00e1c \u0111\u1ec3 th\u1ef1c hi\u1ec7n t\u1ea5n c\u00f4ng Brute Force ho\u1eb7c DDoS, nhi\u1ec1u qu\u1ea3n tr\u1ecb vi\u00ean hi\u1ec7n nay \u0111\u00e3 xem x\u00e9t vi\u1ec7c t\u1eaft xmlrpc.php n\u1ebfu kh\u00f4ng s\u1eed d\u1ee5ng \u0111\u1ebfn n\u00f3.<\/p>\n\n\n\n<h3 id=\"2._H\u1ed7_tr\u1ee3_\u0111\u0103ng_b\u00e0i_t\u1eeb_xa\"><a id=\"post-118869-_gc19r7vovbtv\"><\/a><strong>2. H\u1ed7 tr\u1ee3 \u0111\u0103ng b\u00e0i t\u1eeb xa<\/strong><\/h3>\n\n\n\n<p>Tr\u01b0\u1edbc khi WordPress REST API ra \u0111\u1eddi, xmlrpc.php l\u00e0 c\u00e1ch duy nh\u1ea5t \u0111\u1ec3 ng\u01b0\u1eddi d\u00f9ng \u0111\u0103ng b\u00e0i t\u1eeb xa m\u00e0 kh\u00f4ng c\u1ea7n truy c\u1eadp v\u00e0o tr\u00ecnh qu\u1ea3n tr\u1ecb WordPress. Nh\u1edd t\u00ednh n\u0103ng n\u00e0y, ng\u01b0\u1eddi vi\u1ebft c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng c\u00e1c \u1ee9ng d\u1ee5ng nh\u01b0 Microsoft Word, Open Live Writer ho\u1eb7c WordPress Mobile App \u0111\u1ec3 so\u1ea1n th\u1ea3o v\u00e0 xu\u1ea5t b\u1ea3n b\u00e0i vi\u1ebft ch\u1ec9 v\u1edbi m\u1ed9t v\u00e0i thao t\u00e1c. T\u00ednh n\u0103ng n\u00e0y \u0111\u1eb7c bi\u1ec7t h\u1eefu \u00edch v\u1edbi nh\u1eefng ng\u01b0\u1eddi vi\u1ebft blog th\u01b0\u1eddng xuy\u00ean di chuy\u1ec3n ho\u1eb7c c\u1ea7n qu\u1ea3n l\u00fd n\u1ed9i dung t\u1eeb nhi\u1ec1u thi\u1ebft b\u1ecb kh\u00e1c nhau. <\/p>\n\n\n\n<p>Tuy nhi\u00ean, \u0111i\u1ec3m h\u1ea1n ch\u1ebf c\u1ee7a ph\u01b0\u01a1ng th\u1ee9c n\u00e0y l\u00e0 b\u1ea3o m\u1eadt k\u00e9m, d\u1ec5 b\u1ecb hacker khai th\u00e1c \u0111\u1ec3 g\u1eedi spam ho\u1eb7c t\u1ea5n c\u00f4ng chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n website. V\u00ec v\u1eady, n\u1ebfu kh\u00f4ng s\u1eed d\u1ee5ng t\u00ednh n\u0103ng \u0111\u0103ng b\u00e0i t\u1eeb xa, t\u1ed1t nh\u1ea5t b\u1ea1n n\u00ean t\u1eaft xmlrpc.php \u0111\u1ec3 tr\u00e1nh r\u1ee7i ro.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" width=\"700\" height=\"400\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-4.png\" alt=\"Ch\u1ee9c n\u0103ng c\u1ee7a xmlrpc.php trong WordPress\" class=\"wp-image-118873\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-4.png 700w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-4-300x171.png 300w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><figcaption class=\"wp-element-caption\"><strong>Ch\u1ee9c n\u0103ng c\u1ee7a xmlrpc.php trong WordPress<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<h3 id=\"3._\u0110\u1ed3ng_b\u1ed9_h\u00f3a_d\u1eef_li\u1ec7u_gi\u1eefa_WordPress_v\u00e0_c\u00e1c_n\u1ec1n_t\u1ea3ng_kh\u00e1c\"><a id=\"post-118869-_3o7nqew5qixj\"><\/a><strong>3. \u0110\u1ed3ng b\u1ed9 h\u00f3a d\u1eef li\u1ec7u gi\u1eefa WordPress v\u00e0 c\u00e1c n\u1ec1n t\u1ea3ng kh\u00e1c<\/strong><\/h3>\n\n\n\n<p>Ngo\u00e0i \u0111\u0103ng b\u00e0i t\u1eeb xa, xmlrpc.php c\u0169ng gi\u00fap WordPress \u0111\u1ed3ng b\u1ed9 h\u00f3a d\u1eef li\u1ec7u v\u1edbi c\u00e1c n\u1ec1n t\u1ea3ng b\u00ean ngo\u00e0i, ch\u1eb3ng h\u1ea1n nh\u01b0 h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd n\u1ed9i dung (CMS), c\u00f4ng c\u1ee5 t\u1ef1 \u0111\u1ed9ng h\u00f3a ho\u1eb7c m\u1ea1ng x\u00e3 h\u1ed9i. V\u00ed d\u1ee5, m\u1ed9t s\u1ed1 c\u00f4ng c\u1ee5 SEO ho\u1eb7c ti\u1ebfp th\u1ecb c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng xmlrpc.php \u0111\u1ec3 truy xu\u1ea5t d\u1eef li\u1ec7u b\u00e0i vi\u1ebft v\u00e0 c\u1eadp nh\u1eadt th\u00f4ng tin l\u00ean nhi\u1ec1u n\u1ec1n t\u1ea3ng kh\u00e1c nhau c\u00f9ng m\u1ed9t l\u00fac.<\/p>\n\n\n\n<p>\u0110\u00e2y l\u00e0 c\u00e1ch gi\u00fap ng\u01b0\u1eddi d\u00f9ng ti\u1ebft ki\u1ec7m th\u1eddi gian v\u00e0 qu\u1ea3n l\u00fd n\u1ed9i dung hi\u1ec7u qu\u1ea3 h\u01a1n. Tuy nhi\u00ean, do xmlrpc.php ho\u1ea1t \u0111\u1ed9ng b\u1eb1ng c\u00e1ch m\u1edf c\u1ed5ng k\u1ebft n\u1ed1i li\u00ean t\u1ee5c v\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng b\u00ean ngo\u00e0i, n\u00f3 c\u00f3 th\u1ec3 l\u00e0m website t\u0103ng t\u1ea3i kh\u00f4ng c\u1ea7n thi\u1ebft ho\u1eb7c tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau t\u1ea5n c\u00f4ng t\u1eeb hacker. V\u00ec th\u1ebf, c\u1ea7n c\u00e2n nh\u1eafc k\u1ef9 tr\u01b0\u1edbc khi k\u00edch ho\u1ea1t ho\u1eb7c v\u00f4 hi\u1ec7u h\u00f3a t\u00ednh n\u0103ng n\u00e0y.<\/p>\n\n\n\n<h3 id=\"4._API_XML-RPC_so_v\u1edbi_REST_API_trong_WordPress\"><a id=\"post-118869-_ddm36urlzm8b\"><\/a><strong>4. API XML-RPC so v\u1edbi REST API trong WordPress<\/strong><\/h3>\n\n\n\n<p>D\u00f9 xmlrpc.php t\u1eebng l\u00e0 c\u00f4ng c\u1ee5 quan tr\u1ecdng trong h\u1ec7 sinh th\u00e1i WordPress, nh\u01b0ng khi ra \u0111\u1eddi, REST API \u0111\u00e3 tr\u1edf n\u00ean l\u1ed7i th\u1eddi. REST API s\u1eed d\u1ee5ng JSON thay v\u00ec XML, gi\u00fap d\u1eef li\u1ec7u truy\u1ec1n t\u1ea3i nhanh h\u01a1n, g\u1ecdn nh\u1eb9 h\u01a1n v\u00e0 \u0111\u1eb7c bi\u1ec7t l\u00e0 b\u1ea3o m\u1eadt t\u1ed1t h\u01a1n. Ngo\u00e0i ra, REST API c\u00f2n c\u00f3 th\u1ec3 t\u00edch h\u1ee3p d\u1ec5 d\u00e0ng v\u1edbi nhi\u1ec1u n\u1ec1n t\u1ea3ng web, \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng v\u00e0 d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y, trong khi xmlrpc.php ch\u1ee7 y\u1ebfu d\u1ef1a tr\u00ean c\u00e1c ph\u01b0\u01a1ng th\u1ee9c c\u0169 v\u00e0 d\u1ec5 b\u1ecb khai th\u00e1c l\u1ed7 h\u1ed5ng.<\/p>\n\n\n\n<p>Ch\u00ednh v\u00ec nh\u1eefng l\u00fd do n\u00e0y, WordPress \u0111\u00e3 d\u1ea7n h\u01b0\u1edbng \u0111\u1ebfn REST API nh\u01b0 m\u1ed9t gi\u1ea3i ph\u00e1p thay th\u1ebf to\u00e0n di\u1ec7n. N\u1ebfu website c\u1ee7a b\u1ea1n kh\u00f4ng c\u00f3 nhu c\u1ea7u s\u1eed d\u1ee5ng xmlrpc.php, b\u1ea1n n\u00ean v\u00f4 hi\u1ec7u h\u00f3a n\u00f3 v\u00e0 chuy\u1ec3n sang REST API \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o b\u1ea3o m\u1eadt t\u1ed1t h\u01a1n.<\/p>\n\n\n\n<h2 id=\"Nh\u1eefng_r\u1ee7i_ro_b\u1ea3o_m\u1eadt_khi_s\u1eed_d\u1ee5ng_xmlrpc.php\"><a id=\"post-118869-_m39bypqp5lnx\"><\/a>Nh\u1eefng r\u1ee7i ro b\u1ea3o m\u1eadt khi s\u1eed d\u1ee5ng xmlrpc.php<\/h2>\n\n\n\n<h3 id=\"1._D\u1ec5_b\u1ecb_t\u1ea5n_c\u00f4ng_DDoS\"><a id=\"post-118869-_uxzpf4epcxew\"><\/a><strong>1. D\u1ec5 b\u1ecb t\u1ea5n c\u00f4ng DDoS<\/strong><\/h3>\n\n\n\n<p>M\u1ed9t trong nh\u1eefng r\u1ee7i ro l\u1edbn nh\u1ea5t c\u1ee7a xmlrpc.php l\u00e0 c\u00f3 th\u1ec3 b\u1ecb l\u1ee3i d\u1ee5ng \u0111\u1ec3 th\u1ef1c hi\u1ec7n t\u1ea5n c\u00f4ng DDoS (<strong>Distributed Denial of Service<\/strong>). Hacker c\u00f3 th\u1ec3 khai th\u00e1c t\u00ednh n\u0103ng pingback c\u1ee7a xmlrpc.php \u0111\u1ec3 g\u1eedi h\u00e0ng lo\u1ea1t y\u00eau c\u1ea7u t\u1eeb nhi\u1ec1u ngu\u1ed3n kh\u00e1c nhau, l\u00e0m qu\u00e1 t\u1ea3i m\u00e1y ch\u1ee7 v\u00e0 khi\u1ebfn website b\u1ecb ch\u1eadm ho\u1eb7c s\u1eadp ho\u00e0n to\u00e0n.<\/p>\n\n\n\n<p>Nguy hi\u1ec3m h\u01a1n h\u1ebft l\u00e0 h\u00ecnh th\u1ee9c t\u1ea5n c\u00f4ng n\u00e0y kh\u00f4ng \u0111\u00f2i h\u1ecfi nhi\u1ec1u t\u00e0i nguy\u00ean, nh\u01b0ng l\u1ea1i c\u00f3 th\u1ec3 g\u00e2y \u1ea3nh h\u01b0\u1edfng nghi\u00eam tr\u1ecdng \u0111\u1ebfn hi\u1ec7u su\u1ea5t v\u00e0 ho\u1ea1t \u0111\u1ed9ng c\u1ee7a trang web.<\/p>\n\n\n\n<h3 id=\"2._T\u1ea5n_c\u00f4ng_Brute_Force_v\u00e0o_t\u00e0i_kho\u1ea3n_qu\u1ea3n_tr\u1ecb\"><a id=\"post-118869-_wdvjs6a94xak\"><\/a><strong>2. T\u1ea5n c\u00f4ng Brute Force v\u00e0o t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb<\/strong><\/h3>\n\n\n\n<p>M\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng kh\u00e1c c\u1ee7a xmlrpc.php l\u00e0 c\u00f3 th\u1ec3 b\u1ecb khai th\u00e1c \u0111\u1ec3 th\u1ef1c hi\u1ec7n t\u1ea5n c\u00f4ng Brute Force nh\u1eb1m \u0111o\u00e1n m\u1eadt kh\u1ea9u \u0111\u0103ng nh\u1eadp v\u00e0o WordPress. Th\u00f4ng th\u01b0\u1eddng, n\u1ebfu hacker mu\u1ed1n t\u1ea5n c\u00f4ng b\u1eb1ng Brute Force qua trang \u0111\u0103ng nh\u1eadp, h\u1ecd s\u1ebd ph\u1ea3i th\u1eed t\u1eebng t\u00e0i kho\u1ea3n v\u00e0 m\u1eadt kh\u1ea9u m\u1ed9t c\u00e1ch th\u1ee7 c\u00f4ng. Nh\u01b0ng v\u1edbi xmlrpc.php, h\u1ecd c\u00f3 th\u1ec3 g\u1eedi h\u00e0ng tr\u0103m y\u00eau c\u1ea7u \u0111\u0103ng nh\u1eadp ch\u1ec9 trong m\u1ed9t l\u1ea7n g\u1eedi d\u1eef li\u1ec7u, gi\u00fap \u0111\u1ea9y nhanh qu\u00e1 tr\u00ecnh th\u1eed m\u1eadt kh\u1ea9u.<\/p>\n\n\n\n<h3 id=\"3._L\u1ed7_h\u1ed5ng_b\u1ea3o_m\u1eadt_c\u00f3_th\u1ec3_b\u1ecb_hacker_t\u1ea5n_c\u00f4ng\"><a id=\"post-118869-_1cvtz9w51q4l\"><\/a><strong>3. L\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt c\u00f3 th\u1ec3 b\u1ecb hacker t\u1ea5n c\u00f4ng<\/strong><\/h3>\n\n\n\n<p>Do xmlrpc.php \u0111\u00e3 c\u00f3 t\u1eeb l\u00e2u v\u00e0 kh\u00f4ng c\u00f2n \u0111\u01b0\u1ee3c WordPress t\u1eadp trung ph\u00e1t tri\u1ec3n, n\u00ean \u0111\u00e2y \u0111\u00e3 tr\u1edf th\u00e0nh m\u1ed9t trong nh\u1eefng \u0111i\u1ec3m y\u1ebfu b\u1ea3o m\u1eadt d\u1ec5 b\u1ecb khai th\u00e1c. Hacker c\u00f3 th\u1ec3 t\u00ecm ki\u1ebfm v\u00e0 s\u1eed d\u1ee5ng c\u00e1c l\u1ed7i b\u1ea3o m\u1eadt ch\u01b0a \u0111\u01b0\u1ee3c v\u00e1 \u0111\u1ec3 t\u1ea5n c\u00f4ng v\u00e0o website, chi\u1ebfm quy\u1ec1n ki\u1ec3m so\u00e1t ho\u1eb7c ch\u00e8n m\u00e3 \u0111\u1ed9c.<\/p>\n\n\n\n<p>Ngo\u00e0i ra, v\u00ec xmlrpc.php th\u01b0\u1eddng b\u1ecb b\u1ecf qua trong c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o v\u1ec7, nhi\u1ec1u website kh\u00f4ng c\u00f3 c\u01a1 ch\u1ebf gi\u00e1m s\u00e1t ho\u1eb7c ph\u00e1t hi\u1ec7n t\u1ea5n c\u00f4ng s\u1edbm, khi\u1ebfn hacker d\u1ec5 d\u00e0ng l\u1ee3i d\u1ee5ng n\u00f3 \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n ngay l\u1eadp t\u1ee9c.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" width=\"700\" height=\"400\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-5.png\" alt=\"Nh\u1eefng r\u1ee7i ro b\u1ea3o m\u1eadt khi s\u1eed d\u1ee5ng xmlrpc.php\" class=\"wp-image-118874\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-5.png 700w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-5-300x171.png 300w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><figcaption class=\"wp-element-caption\"><strong>Nh\u1eefng r\u1ee7i ro b\u1ea3o m\u1eadt khi s\u1eed d\u1ee5ng xmlrpc.php<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<h3 id=\"V\u00ed_d\u1ee5_v\u1ec1_c\u00e1c_cu\u1ed9c_t\u1ea5n_c\u00f4ng_th\u1ef1c_t\u1ebf_li\u00ean_quan_\u0111\u1ebfn_xmlrpc.php\"><a id=\"post-118869-_rj6vggde7ofa\"><\/a><strong>V\u00ed d\u1ee5 v\u1ec1 c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng th\u1ef1c t\u1ebf li\u00ean quan \u0111\u1ebfn xmlrpc.php<\/strong><\/h3>\n\n\n\n<p>M\u1ed9t v\u00ed d\u1ee5 \u0111i\u1ec3n h\u00ecnh l\u00e0 v\u00e0o n\u0103m 2015, h\u00e0ng lo\u1ea1t website WordPress b\u1ecb t\u1ea5n c\u00f4ng DDoS th\u00f4ng qua l\u1ed7 h\u1ed5ng pingback trong xmlrpc.php. Hacker \u0111\u00e3 s\u1eed d\u1ee5ng h\u01a1n 26.000 website WordPress \u0111\u1ec3 g\u1eedi h\u00e0ng tri\u1ec7u y\u00eau c\u1ea7u pingback, khi\u1ebfn c\u00e1c trang web m\u1ee5c ti\u00eau b\u1ecb t\u00ea li\u1ec7t ho\u00e0n to\u00e0n.<\/p>\n\n\n\n<h2 id=\"C\u00e1ch_ki\u1ec3m_tra_xmlrpc.php_c\u00f3_ho\u1ea1t_\u0111\u1ed9ng_tr\u00ean_website_WordPress_kh\u00f4ng\"><a id=\"post-118869-_ss8405caxddy\"><\/a>C\u00e1ch ki\u1ec3m tra xmlrpc.php c\u00f3 ho\u1ea1t \u0111\u1ed9ng tr\u00ean website WordPress kh\u00f4ng<\/h2>\n\n\n\n<p>N\u1ebfu mu\u1ed1n bi\u1ebft xmlrpc.php c\u00f3 ho\u1ea1t \u0111\u1ed9ng tr\u00ean website WordPress hay kh\u00f4ng, b\u1ea1n c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n m\u1ed9t trong nh\u1eefng c\u00e1ch sau:<\/p>\n\n\n\n<h3 id=\"1._Ki\u1ec3m_tra_b\u1eb1ng_XML-RPC_Validator\"><a id=\"post-118869-_bybnj7ckevdy\"><\/a><strong>1. Ki\u1ec3m tra b\u1eb1ng XML-RPC Validator<\/strong><\/h3>\n\n\n\n<p>C\u00e1ch \u0111\u01a1n gi\u1ea3n nh\u1ea5t l\u00e0 s\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 tr\u1ef1c tuy\u1ebfn XML-RPC Validator. C\u00e1c b\u01b0\u1edbc th\u1ef1c hi\u1ec7n nh\u01b0 sau:<\/p>\n\n\n\n<p><strong>B\u01b0\u1edbc 1: <\/strong>Truy c\u1eadp trang <a href=\"https:\/\/xmlrpc.blog\/\" target=\"_blank\" data-type=\"link\" data-id=\"https:\/\/xmlrpc.blog\/\" rel=\"noreferrer noopener nofollow\">XML-RPC Validator<\/a>.<\/p>\n\n\n\n<p><strong>B\u01b0\u1edbc 2:<\/strong> Nh\u1eadp t\u00ean mi\u1ec1n website c\u1ee7a b\u1ea1n v\u00e0o \u00f4 v\u00e0 nh\u1ea5n n\u00fat <strong>Check<\/strong> \u0111\u1ec3 ki\u1ec3m tra.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" width=\"1024\" height=\"525\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/1-1024x525.png\" alt=\"Ki\u1ec3m tra b\u1eb1ng XML-RPC Validator\" class=\"wp-image-118880\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/1-1024x525.png 1024w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/1-300x154.png 300w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/1-768x394.png 768w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/1.png 1148w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><strong>Ki\u1ec3m tra b\u1eb1ng XML-RPC Validator<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><p><b>Th\u00f4ng b\u00e1o l\u1ed7i (m\u00e0u \u0111\u1ecf):<\/b> \u0110i\u1ec1u n\u00e0y c\u00f3 ngh\u0129a l\u00e0 <code>xmlrpc.php<\/code> \u0111\u00e3 b\u1ecb t\u1eaft ho\u1eb7c b\u1ecb ch\u1eb7n b\u1edfi t\u01b0\u1eddng l\u1eeda. \u0110\u00e2y th\u01b0\u1eddng l\u00e0 m\u1ed9t t\u00edn hi\u1ec7u t\u1ed1t v\u1ec1 m\u1eb7t b\u1ea3o m\u1eadt.<\/p><\/p>\n\n\n\n<p><p><b>Th\u00f4ng b\u00e1o th\u00e0nh c\u00f4ng (m\u00e0u xanh):<\/b> \u0110i\u1ec1u n\u00e0y c\u00f3 ngh\u0129a l\u00e0 t\u1ec7p <code>xmlrpc.php<\/code> \u0111ang ho\u1ea1t \u0111\u1ed9ng tr\u00ean trang web c\u1ee7a b\u1ea1n.<\/p><\/p>\n\n\n\n<p>Trong tr\u01b0\u1eddng h\u1ee3p th\u1ea5y l\u1ed7i sau, ngh\u0129a l\u00e0 c\u00f4ng c\u1ee5 ki\u1ec3m tra <b>kh\u00f4ng th\u1ec3 ho\u00e0n th\u00e0nh<\/b> vi\u1ec7c ki\u1ec3m tra t\u1ec7p <code>xmlrpc.php<\/code> tr\u00ean trang web c\u1ee7a b\u1ea1n. C\u00e1c plugin nh\u01b0 <b>Wordfence, iThemes Security, Sucuri Security<\/b> th\u01b0\u1eddng c\u00f3 t\u00ednh n\u0103ng t\u01b0\u1eddng l\u1eeda (Firewall). Khi ph\u00e1t hi\u1ec7n m\u1ed9t y\u00eau c\u1ea7u truy c\u1eadp v\u00e0o <code>xmlrpc.php<\/code>, ch\u00fang s\u1ebd ch\u1ee7 \u0111\u1ed9ng ch\u1eb7n v\u00e0 ng\u1eaft k\u1ebft n\u1ed1i thay v\u00ec g\u1eedi l\u1ea1i m\u1ed9t th\u00f4ng b\u00e1o l\u1ed7i chu\u1ea9n. \u0110\u00e2y l\u00e0 m\u1ed9t bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt hi\u1ec7u qu\u1ea3.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" width=\"1024\" height=\"475\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/2-1024x475.png\" alt=\"Ki\u1ec3m tra b\u1eb1ng XML-RPC Validator\" class=\"wp-image-118881\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/2-1024x475.png 1024w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/2-300x139.png 300w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/2-768x356.png 768w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/2.png 1349w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><strong>Ki\u1ec3m tra b\u1eb1ng XML-RPC Validator<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<h3 id=\"2._Ki\u1ec3m_tra_trong_m\u00e3_ngu\u1ed3n_c\u1ee7a_plugin_v\u00e0_theme\"><a id=\"post-118869-_1ojzelaq2auz\"><\/a><strong>2. Ki\u1ec3m tra trong m\u00e3 ngu\u1ed3n c\u1ee7a plugin v\u00e0 theme<\/strong><\/h3>\n\n\n\n<p>N\u1ebfu b\u1ea1n x\u00e1c \u0111\u1ecbnh xmlrpc.php \u0111ang ho\u1ea1t \u0111\u1ed9ng, h\u00e3y ki\u1ec3m tra xem c\u00f3 plugin ho\u1eb7c theme n\u00e0o \u0111ang s\u1eed d\u1ee5ng n\u00f3 kh\u00f4ng b\u1eb1ng c\u00e1ch:<\/p>\n\n\n\n<p><strong>B\u01b0\u1edbc 1: T<\/strong>ruy c\u1eadp v\u00e0o cPanel c\u1ee7a hosting ho\u1eb7c s\u1eed d\u1ee5ng sFTP client.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"786\" height=\"519\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/3.png\" alt=\"Ki\u1ec3m tra trong m\u00e3 ngu\u1ed3n c\u1ee7a plugin v\u00e0 theme\" class=\"wp-image-118883\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/3.png 786w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/3-300x198.png 300w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/3-768x507.png 768w\" sizes=\"(max-width: 786px) 100vw, 786px\" \/><figcaption class=\"wp-element-caption\"><strong>Ki\u1ec3m tra trong m\u00e3 ngu\u1ed3n c\u1ee7a plugin v\u00e0 theme<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><strong>B\u01b0\u1edbc 2: <\/strong>V\u00e0o c\u00e1c th\u01b0 m\u1ee5c:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\/wp-content\/plugins\/ (n\u01a1i ch\u1ee9a c\u00e1c plugin \u0111ang c\u00e0i \u0111\u1eb7t).<\/strong><\/li>\n\n\n\n<li><strong>\/wp-content\/themes\/ (n\u01a1i ch\u1ee9a theme \u0111ang s\u1eed d\u1ee5ng).<\/strong><\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"722\" height=\"627\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/4.png\" alt=\"Ki\u1ec3m tra trong m\u00e3 ngu\u1ed3n c\u1ee7a plugin v\u00e0 theme\" class=\"wp-image-118882\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/4.png 722w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/4-300x261.png 300w\" sizes=\"(max-width: 722px) 100vw, 722px\" \/><figcaption class=\"wp-element-caption\"><strong>Ki\u1ec3m tra trong m\u00e3 ngu\u1ed3n c\u1ee7a plugin v\u00e0 theme<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p>T\u00ecm ki\u1ebfm c\u1ee5m t\u1eeb <strong>xmlrpc.php<\/strong> trong m\u00e3 ngu\u1ed3n.<\/p>\n\n\n\n<p>N\u1ebfu th\u1ea5y c\u00f3 plugin ho\u1eb7c theme \u0111ang s\u1eed d\u1ee5ng xmlrpc.php, b\u1ea1n c\u1ea7n xem x\u00e9t li\u1ec7u n\u00f3 c\u00f3 c\u1ea7n thi\u1ebft hay kh\u00f4ng v\u00e0 c\u00f3 th\u1ec3 t\u1eaft xmlrpc.php n\u1ebfu kh\u00f4ng d\u00f9ng \u0111\u1ebfn.<\/p>\n\n\n\n<h2 id=\"Ph\u01b0\u01a1ng_ph\u00e1p_v\u00f4_hi\u1ec7u_ho\u00e1_xmlrpc.php_trong_WordPress\"><a id=\"post-118869-_5ae46wiqbi3f\"><\/a>Ph\u01b0\u01a1ng ph\u00e1p v\u00f4 hi\u1ec7u ho\u00e1 xmlrpc.php trong WordPress<\/h2>\n\n\n\n<h3 id=\"1._V\u00f4_hi\u1ec7u_h\u00f3a_xmlrpc.php_b\u1eb1ng_plugin_b\u1ea3o_m\u1eadt\"><a id=\"post-118869-_2im45ava0qfx\"><\/a><strong>1. V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php b\u1eb1ng plugin b\u1ea3o m\u1eadt<\/strong><\/h3>\n\n\n\n<p>\u0110\u00e2y l\u00e0 c\u00e1ch \u0111\u01a1n gi\u1ea3n v\u00e0 an to\u00e0n nh\u1ea5t, \u0111\u1eb7c bi\u1ec7t n\u1ebfu b\u1ea1n kh\u00f4ng mu\u1ed1n ch\u1ec9nh s\u1eeda tr\u1ef1c ti\u1ebfp v\u00e0o m\u00e3 ngu\u1ed3n c\u1ee7a WordPress. M\u1ed9t s\u1ed1 plugin b\u1ea3o m\u1eadt nh\u01b0 Solid Security cho ph\u00e9p b\u1ea1n t\u1eaft xmlrpc.php ch\u1ec9 v\u1edbi v\u00e0i thao t\u00e1c.<\/p>\n\n\n\n<p><em>C\u00e1ch th\u1ef1c hi\u1ec7n:<\/em><\/p>\n\n\n\n<p><strong>B\u01b0\u1edbc 1: <\/strong>C\u00e0i \u0111\u1eb7t v\u00e0 k\u00edch ho\u1ea1t plugin<strong> Solid Security <\/strong>(ho\u1eb7c plugin b\u1ea3o m\u1eadt t\u01b0\u01a1ng t\u1ef1).<\/p>\n\n\n\n<p><strong><strong>B\u01b0\u1edbc 2: <\/strong><\/strong>Truy c\u1eadp<strong> Security > Settings > Advanced<\/strong> trong b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n WordPress.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" width=\"445\" height=\"452\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-8.png\" alt=\"\" class=\"wp-image-118877\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-8.png 445w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-8-295x300.png 295w\" sizes=\"(max-width: 445px) 100vw, 445px\" \/><figcaption class=\"wp-element-caption\"><strong>V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php b\u1eb1ng plugin b\u1ea3o m\u1eadt<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><strong>B\u01b0\u1edbc 3: <\/strong>T\u00ecm \u0111\u1ebfn m\u1ee5c<strong> WordPress Tweaks<\/strong>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" width=\"637\" height=\"693\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-9.png\" alt=\"V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php b\u1eb1ng plugin b\u1ea3o m\u1eadt\" class=\"wp-image-118878\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-9.png 637w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-9-276x300.png 276w\" sizes=\"(max-width: 637px) 100vw, 637px\" \/><figcaption class=\"wp-element-caption\"><strong>V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php b\u1eb1ng plugin b\u1ea3o m\u1eadt<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p>T\u1ea1i ph\u1ea7n<strong> API Access<\/strong>, t\u00ecm t\u00f9y ch\u1ecdn<strong> XML-RPC settings<\/strong>.<\/p>\n\n\n\n<p>Ch\u1ecdn<strong> Disable XML-RPC <\/strong>\u0111\u1ec3 t\u1eaft ho\u00e0n to\u00e0n ch\u1ee9c n\u0103ng n\u00e0y.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" width=\"582\" height=\"141\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-10.png\" alt=\"V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php b\u1eb1ng plugin b\u1ea3o m\u1eadt\" class=\"wp-image-118879\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-10.png 582w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/word-image-118869-10-300x73.png 300w\" sizes=\"(max-width: 582px) 100vw, 582px\" \/><figcaption class=\"wp-element-caption\"><strong>V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php b\u1eb1ng plugin b\u1ea3o m\u1eadt<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><\/p>\n\n\n\n<p><strong>B\u01b0\u1edbc 4: <\/strong>Nh\u1ea5n <strong>Save changes<\/strong> \u0111\u1ec3 l\u01b0u c\u00e0i \u0111\u1eb7t.<\/p>\n\n\n\n<p><em>L\u01b0u \u00fd:<\/em> M\u1ed9t s\u1ed1 plugin ho\u1eb7c d\u1ecbch v\u1ee5 b\u00ean th\u1ee9 ba c\u00f3 th\u1ec3 c\u1ea7n s\u1eed d\u1ee5ng xmlrpc.php \u0111\u1ec3 ho\u1ea1t \u0111\u1ed9ng. N\u1ebfu sau khi t\u1eaft xmlrpc.php m\u00e0 website g\u1eb7p l\u1ed7i, b\u1ea1n c\u00f3 th\u1ec3 k\u00edch ho\u1ea1t l\u1ea1i ho\u1eb7c li\u00ean h\u1ec7 b\u1ed9 ph\u1eadn h\u1ed7 tr\u1ee3 c\u1ee7a Solid Security \u0111\u1ec3 \u0111\u01b0\u1ee3c h\u01b0\u1edbng d\u1eabn.<\/p>\n\n\n\n<h3 id=\"2._V\u00f4_hi\u1ec7u_h\u00f3a_xmlrpc.php_th\u1ee7_c\u00f4ng_b\u1eb1ng_.htaccess\"><a id=\"post-118869-_pncvbfesni9b\"><\/a><strong>2. V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php th\u1ee7 c\u00f4ng b\u1eb1ng .htaccess<\/strong><\/h3>\n\n\n\n<p>N\u1ebfu c\u00f3 kinh nghi\u1ec7m ch\u1ec9nh s\u1eeda m\u00e3 ngu\u1ed3n, b\u1ea1n c\u00f3 th\u1ec3 t\u1eaft xmlrpc.php b\u1eb1ng c\u00e1ch ch\u1ec9nh s\u1eeda file .htaccess. \u0110\u00e2y l\u00e0 m\u1ed9t file quan tr\u1ecdng n\u1eb1m trong th\u01b0 m\u1ee5c g\u1ed1c c\u1ee7a website WordPress, gi\u00fap ki\u1ec3m so\u00e1t c\u00e1c c\u00e0i \u0111\u1eb7t li\u00ean quan \u0111\u1ebfn b\u1ea3o m\u1eadt, chuy\u1ec3n h\u01b0\u1edbng v\u00e0 truy c\u1eadp m\u00e1y ch\u1ee7.<\/p>\n\n\n\n<p><em>H\u01b0\u1edbng d\u1eabn th\u1ef1c hi\u1ec7n:<\/em><br><strong>B\u01b0\u1edbc 1: <\/strong>Truy c\u1eadp th\u01b0 m\u1ee5c g\u1ed1c c\u1ee7a website qua sFTP ho\u1eb7c <strong>File Manager<\/strong> c\u1ee7a cPanel hosting. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"786\" height=\"519\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/3-1.png\" alt=\"V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php th\u1ee7 c\u00f4ng b\u1eb1ng .htaccess\" class=\"wp-image-118884\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/3-1.png 786w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/3-1-300x198.png 300w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/3-1-768x507.png 768w\" sizes=\"(max-width: 786px) 100vw, 786px\" \/><figcaption class=\"wp-element-caption\"><strong>V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php th\u1ee7 c\u00f4ng b\u1eb1ng .htaccess<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><br><strong>B\u01b0\u1edbc 2:<\/strong> M\u1edf file <strong>.htaccess<\/strong> b\u1eb1ng tr\u00ecnh ch\u1ec9nh s\u1eeda v\u0103n b\u1ea3n. <\/p>\n\n\n\n<p><strong>L\u01b0u \u00fd: <\/strong>Sao l\u01b0u file .htaccess tr\u01b0\u1edbc khi ch\u1ec9nh s\u1eeda \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o c\u00f3 th\u1ec3 kh\u00f4i ph\u1ee5c n\u1ebfu g\u1eb7p s\u1ef1 c\u1ed1. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"873\" height=\"548\" src=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/5.png\" alt=\"V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php th\u1ee7 c\u00f4ng b\u1eb1ng .htaccess\" class=\"wp-image-118885\" title=\"\" srcset=\"https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/5.png 873w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/5-300x188.png 300w, https:\/\/tino.vn\/blog\/wp-content\/uploads\/2025\/09\/5-768x482.png 768w\" sizes=\"(max-width: 873px) 100vw, 873px\" \/><figcaption class=\"wp-element-caption\"><strong>V\u00f4 hi\u1ec7u h\u00f3a xmlrpc.php th\u1ee7 c\u00f4ng b\u1eb1ng .htaccess<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p><br><strong>B\u01b0\u1edbc 3: <\/strong>Th\u00eam \u0111o\u1ea1n m\u00e3 sau v\u00e0o cu\u1ed1i file \u0111\u1ec3 ch\u1eb7n ho\u00e0n to\u00e0n truy c\u1eadp v\u00e0o xmlrpc.php:<\/p>\n\n\n\n<p><em>N\u1ebfu s\u1eed d\u1ee5ng Apache phi\u00ean b\u1ea3n c\u0169:<\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Files xmlrpc.php>\n\nOrder Allow,Deny\n\nDeny from all\n\n&lt;\/Files><\/code><\/pre>\n\n\n\n<p><em>N\u1ebfu s\u1eed d\u1ee5ng Apache phi\u00ean b\u1ea3n 2.4 tr\u1edf l\u00ean:<\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Files \"xmlrpc.php\">\n\nRequire all denied\n\n&lt;\/Files><\/code><\/pre>\n\n\n\n<p><strong>B\u01b0\u1edbc 5: <\/strong>L\u01b0u l\u1ea1i file v\u00e0 t\u1ea3i l\u00ean l\u1ea1i m\u00e1y ch\u1ee7 (n\u1ebfu ch\u1ec9nh s\u1eeda b\u1eb1ng sFTP). <br><strong>B\u01b0\u1edbc 6:<\/strong> Ki\u1ec3m tra xem xmlrpc.php \u0111\u00e3 b\u1ecb v\u00f4 hi\u1ec7u h\u00f3a ch\u01b0a b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng XML-RPC Validator. N\u1ebfu n\u00f3 kh\u00f4ng th\u1ec3 truy c\u1eadp, t\u1ee9c l\u00e0 b\u1ea1n \u0111\u00e3 v\u00f4 hi\u1ec7u h\u00f3a th\u00e0nh c\u00f4ng.<\/p>\n\n\n\n<h3 id=\"K\u1ebft_lu\u1eadn\"><strong>K\u1ebft lu\u1eadn<\/strong><\/h3>\n\n\n\n<p>Qua b\u00e0i vi\u1ebft tr\u00ean, Tino hy v\u1ecdng b\u1ea1n \u0111\u00e3 hi\u1ec3u r\u00f5 h\u01a1n v\u1ec1 xmlrpc.php WordPress l\u00e0 g\u00ec. H\u00e3y ti\u1ebfp t\u1ee5c theo d\u00f5i Tino \u0111\u1ec3 \u0111\u00f3n \u0111\u1ecdc nh\u1eefng b\u00e0i vi\u1ebft hay v\u00e0 h\u1eefu \u00edch kh\u00e1c b\u1ea1n nh\u00e9!<\/p>\n\n\n\n<h2 id=\"Nh\u1eefng_c\u00e2u_h\u1ecfi_th\u01b0\u1eddng_g\u1eb7p\"><a id=\"post-118869-_nrfxndlfsvv2\"><\/a>Nh\u1eefng c\u00e2u h\u1ecfi th\u01b0\u1eddng g\u1eb7p<\/h2>\n\n\n\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h2 id=\"xmlrpc.php_c\u00f3_th\u1ec3_b\u1ecb_ch\u1eb7n_b\u1eb1ng_t\u01b0\u1eddng_l\u1eeda_kh\u00f4ng?\">xmlrpc.php c\u00f3 th\u1ec3 b\u1ecb ch\u1eb7n b\u1eb1ng t\u01b0\u1eddng l\u1eeda kh\u00f4ng?<\/h2>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>C\u00f3! B\u1ea1n c\u00f3 th\u1ec3 ch\u1eb7n xmlrpc.php b\u1eb1ng t\u01b0\u1eddng l\u1eeda tr\u00ean m\u00e1y ch\u1ee7 ho\u1eb7c b\u1eb1ng Cloudflare\/WAF \u0111\u1ec3 ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng t\u1eeb xa.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h2 id=\"REST_API_c\u00f3_th\u1ec3_thay_th\u1ebf_xmlrpc.php_kh\u00f4ng?\">REST API c\u00f3 th\u1ec3 thay th\u1ebf xmlrpc.php kh\u00f4ng?<\/h2>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>T\u1ea5t nhi\u00ean l\u00e0 c\u00f3! REST API l\u00e0 c\u00f4ng ngh\u1ec7 m\u1edbi h\u01a1n, an to\u00e0n v\u00e0 t\u1ed1i \u01b0u h\u01a1n xmlrpc.php trong vi\u1ec7c giao ti\u1ebfp gi\u1eefa WordPress v\u00e0 \u1ee9ng d\u1ee5ng b\u00ean ngo\u00e0i.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h2 id=\"xmlrpc.php_c\u00f3_\u1ea3nh_h\u01b0\u1edfng_\u0111\u1ebfn_SEO_kh\u00f4ng?\">xmlrpc.php c\u00f3 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn SEO kh\u00f4ng?<\/h2>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Kh\u00f4ng tr\u1ef1c ti\u1ebfp! Tuy nhi\u00ean, n\u1ebfu website b\u1ecb t\u1ea5n c\u00f4ng DDoS ho\u1eb7c Brute Force qua xmlrpc.php, hi\u1ec7u su\u1ea5t gi\u1ea3m c\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng ti\u00eau c\u1ef1c \u0111\u1ebfn <a href=\"https:\/\/tino.vn\/blog\/seo-la-gi\/\" target=\"_blank\" data-type=\"post\" data-id=\"16068\" rel=\"noreferrer noopener\">SEO<\/a>.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section\t\thelp class=\"sc_fs_faq sc_card    \"\n\t\t\t\t>\n\t\t\t\t<h2 id=\"xmlrpc.php_c\u00f3_th\u1ec3_b\u1ecb_x\u00f3a_ho\u00e0n_to\u00e0n_kh\u00f4ng?\">xmlrpc.php c\u00f3 th\u1ec3 b\u1ecb x\u00f3a ho\u00e0n to\u00e0n kh\u00f4ng?<\/h2>\t\t\t\t<div>\n\t\t\t\t\t\t<div class=\"sc_fs_faq__content\">\n\t\t\t\t\n\n<p>Kh\u00f4ng n\u00ean! X\u00f3a file n\u00e0y c\u00f3 th\u1ec3 g\u00e2y l\u1ed7i v\u1edbi c\u00e1c plugin c\u1ea7n xmlrpc.php. C\u00e1ch t\u1ed1t nh\u1ea5t l\u00e0 v\u00f4 hi\u1ec7u h\u00f3a n\u00f3 thay v\u00ec x\u00f3a.<\/p>\n\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t<\/section>\n\t\t\n<script type=\"application\/ld+json\">\n\t{\n\t\t\"@context\": \"https:\/\/schema.org\",\n\t\t\"@type\": \"FAQPage\",\n\t\t\"mainEntity\": [\n\t\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"xmlrpc.php c\u00f3 th\u1ec3 b\u1ecb ch\u1eb7n b\u1eb1ng t\u01b0\u1eddng l\u1eeda kh\u00f4ng?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>C\u00f3! B\u1ea1n c\u00f3 th\u1ec3 ch\u1eb7n xmlrpc.php b\u1eb1ng t\u01b0\u1eddng l\u1eeda tr\u00ean m\u00e1y ch\u1ee7 ho\u1eb7c b\u1eb1ng Cloudflare\/WAF \u0111\u1ec3 ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng t\u1eeb xa.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"REST API c\u00f3 th\u1ec3 thay th\u1ebf xmlrpc.php kh\u00f4ng?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>T\u1ea5t nhi\u00ean l\u00e0 c\u00f3! REST API l\u00e0 c\u00f4ng ngh\u1ec7 m\u1edbi h\u01a1n, an to\u00e0n v\u00e0 t\u1ed1i \u01b0u h\u01a1n xmlrpc.php trong vi\u1ec7c giao ti\u1ebfp gi\u1eefa WordPress v\u00e0 \u1ee9ng d\u1ee5ng b\u00ean ngo\u00e0i.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"xmlrpc.php c\u00f3 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn SEO kh\u00f4ng?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Kh\u00f4ng tr\u1ef1c ti\u1ebfp! Tuy nhi\u00ean, n\u1ebfu website b\u1ecb t\u1ea5n c\u00f4ng DDoS ho\u1eb7c Brute Force qua xmlrpc.php, hi\u1ec7u su\u1ea5t gi\u1ea3m c\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng ti\u00eau c\u1ef1c \u0111\u1ebfn <a>SEO<\/a>.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t,\t\t\t\t{\n\t\t\t\t\"@type\": \"Question\",\n\t\t\t\t\"name\": \"xmlrpc.php c\u00f3 th\u1ec3 b\u1ecb x\u00f3a ho\u00e0n to\u00e0n kh\u00f4ng?\",\n\t\t\t\t\"acceptedAnswer\": {\n\t\t\t\t\t\"@type\": \"Answer\",\n\t\t\t\t\t\"text\": \"<p>Kh\u00f4ng n\u00ean! X\u00f3a file n\u00e0y c\u00f3 th\u1ec3 g\u00e2y l\u1ed7i v\u1edbi c\u00e1c plugin c\u1ea7n xmlrpc.php. C\u00e1ch t\u1ed1t nh\u1ea5t l\u00e0 v\u00f4 hi\u1ec7u h\u00f3a n\u00f3 thay v\u00ec x\u00f3a.<\/p>\"\n\t\t\t\t\t\t\t\t\t}\n\t\t\t}\n\t\t\t\t\t\t]\n\t}\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>B\u1ea1n c\u00f3 bao gi\u1edd t\u1ef1 h\u1ecfi t\u1ea1i sao website WordPress c\u1ee7a m\u00ecnh ho\u1ea1t \u0111\u1ed9ng ch\u1eadm ho\u1eb7c d\u1ec5 b\u1ecb t\u1ea5n c\u00f4ng? M\u1ed9t trong nh\u1eefng nguy\u00ean nh\u00e2n c\u00f3 th\u1ec3 \u0111\u1ebfn t\u1eeb xmlrpc.php \u2013 m\u1ed9t t\u00ednh n\u0103ng h\u1ed7 tr\u1ee3 k\u1ebft n\u1ed1i t\u1eeb xa nh\u01b0ng c\u0169ng l\u00e0 c\u00e1nh c\u1eeda \u0111\u1ec3 hacker t\u1ea5n c\u00f4ng. V\u1eady xmlrpc.php trong WordPress l\u00e0 g\u00ec? [&hellip;]<\/p>\n","protected":false},"author":23,"featured_media":118886,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7381],"tags":[7386],"class_list":["post-118869","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bao-mat-wordpress","tag-bao-mat-wordpress"],"_links":{"self":[{"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/posts\/118869","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/comments?post=118869"}],"version-history":[{"count":4,"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/posts\/118869\/revisions"}],"predecessor-version":[{"id":118890,"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/posts\/118869\/revisions\/118890"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/media\/118886"}],"wp:attachment":[{"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/media?parent=118869"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/categories?post=118869"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tino.vn\/blog\/wp-json\/wp\/v2\/tags?post=118869"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}