Yesterday I suffered a **DDoS attack** on a WordPress site. I had **21,443 hits** with HTTP Status code 404 and a Bandwidth of **711.85 MB**. Also, CPU usage went to 100%.

Logs show a lot of this entries:

```
...
119.71.5.44 - - [03/Sep/2014:18:34:57 -0700] "POST /xmlrpc.php HTTP/1.1" 404 34826 "-" "-"
197.149.17.195 - - [03/Sep/2014:18:35:01 -0700] "POST /xmlrpc.php HTTP/1.0" 404 34826 "-" "-"
210.206.226.130 - - [03/Sep/2014:18:35:04 -0700] "POST /xmlrpc.php HTTP/1.1" 404 34826 "-" "-"
...

```

I'm trying to understand this log.

1. This was only a DDoS attack or they were trying to hack my site?
2. Was I under attack or they used my site to attack others? (all IPs entries are different)
3. What is the best way to stop this? [Modify .htaccess file](http://www.jesusamieiro.com/proteccion-para-la-vulnerabilidad-xml-rpc-de-wordpress/) or [Add a filter in functions.php](http://blogs.tunelko.com/2014/08/17/avoiding-wordpress-xmlrpc-attack-how-to-mitigate/)

---

**Update: Background information**

* I had WordPress 3.9.2. Now, I've updated WordPress to the latest version (4.0).
* The site is on a shared hosting (with cPanel X).
* The attack started on 02/Sep/2014 18:06:57 -0700 and ended 03/Sep/2014 21:22:24 -0700

Also, an hour before the attack the log shows this:

```
82.27.195.149 - - [02/Sep/2014:16:50:52 -0700] "GET /xmlrpc.php HTTP/1.1" 200 42 "-" "Mozilla/5.0 (Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20100101 Firefox/8.0"
82.27.195.149 - - [02/Sep/2014:16:50:54 -0700] "GET /wp-login.php HTTP/1.1" 200 2663 "-" "Mozilla/5.0 (Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20100101 Firefox/8.0"

```

And two hours after it started I've found this:

```
184.176.42.181 - - [02/Sep/2014:19:58:18 -0700] "GET /wp-login.php HTTP/1.1" 200 2663 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"
184.176.42.181 - - [02/Sep/2014:19:58:18 -0700] "POST /wp-login.php HTTP/1.1" 200 2843 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"
184.176.42.181 - - [02/Sep/2014:19:58:18 -0700] "POST /wp-login.php HTTP/1.1" 200 2843 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"
184.176.42.181 - - [02/Sep/2014:19:58:19 -0700] "POST /wp-login.php HTTP/1.1" 200 2843 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"
184.176.42.181 - - [02/Sep/2014:19:58:19 -0700] "POST /wp-login.php HTTP/1.1" 200 2843 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"
184.176.42.181 - - [02/Sep/2014:19:58:20 -0700] "POST /wp-login.php HTTP/1.1" 200 2843 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"
184.176.42.181 - - [02/Sep/2014:19:58:20 -0700] "POST /wp-login.php HTTP/1.1" 200 2843 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"
184.176.42.181 - - [02/Sep/2014:19:58:20 -0700] "POST /wp-login.php HTTP/1.1" 200 2843 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"
184.176.42.181 - - [02/Sep/2014:19:58:21 -0700] "GET /blog/wp-login.php HTTP/1.1" 404 34107 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36"

```

So, I guess they were trying to hack my account through XML-RPC.