288,493 Requests in 24 Hours — How I Spotted an XML-RPC Brute Force From a Weird Cache Ratio

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

A 0.8% Cloudflare cache ratio led me to a single Singapore IP flooding a WordPress site with 288k xmlrpc.php requests in 24 hours. How to detect it via Cloudflare GraphQL, what system.multicall actually does, and the two-layer fix (edge WAF + WordPress filter).

Read on marcindudek.dev ↗