Disable access to xmprpc.php for all domains in Nginx

nginx_disable_xmlrpc.sh

#!/bin/bash

# Threshold for the number of xmlrpc processes indicating an attack
THRESHOLD=50

# Path to the custom Nginx configuration include file
NGINX_CONF="/etc/nginx/conf.d/custom_code_for_all_domains.conf"

# Function to log the change
log_change() {
    echo "$(date): Nginx configuration updated to block xmlrpc.php due to high number of xmlrpc processes" >> /var/log/nginx_xmlrpc_block.log
}

# Check the number of xmlrpc processes running
NUM_PROCESSES=$(ps aux | grep -v grep | grep -c xmlrpc)

if (( NUM_PROCESSES > THRESHOLD )); then
    echo "Server under attack, number of xmlrpc processes: $NUM_PROCESSES"

    # Create or update the Nginx configuration to block xmlrpc.php
    cat <<EOL > $NGINX_CONF
server {
    location = /xmlrpc.php {
        return 301 http://127.0.0.1/;
    }
}
EOL

    # Test the Nginx configuration
    nginx -t

    if [ $? -eq 0 ]; then
        # Reload Nginx to apply the changes
        systemctl reload nginx

        # Log the change
        log_change
    else
        echo "Nginx configuration test failed. Changes not applied."
    fi
else
    echo "Server not under attack, number of xmlrpc processes: $NUM_PROCESSES"
fi