to exhaust the target Blog B, being by overloading bandwidth or the server CPU (DDoS). WordPress changed a bit how the pingback feature works to mitigate this kind of vulnerability: the IP address that originated the pingback (the attacker address) started being recorded, and thus shown in the log. Notwithstanding, in 2016, pingback attacks continued to exist, supposedly because the website owners don't check the user agent logs, that have the real IP addresses. It has to be noted that, if the attacker is more than a script kiddie, he will know how to prevent his IP address being recorded, by, for example, sending the request from another machine/site, so that this machine/site IP address is recorded instead, and the IP logging then, becomes less worthy. Thus, it's still recommended to disable the pingbacks, to prevent attacking other sites (although this does not prevent being target of attacks). See also Weblogs.com, an earlier XML-RPC interface for weblogs to send pingbacks. Webmention, a modern re-implementation of Pingback using HTTP and x-www-urlencoded POST data. Linkback, the suite of protocols that allows websites to manually and automatically link to one another. Refback, a similar protocol but easier than pingbacks since the site originating the link doesn't have to be capable of sending a pingback. Trackback, a similar protocol but more prone to spam. Search engine optimization References Blogs WordPress Drupal