gistfile1.txt

SecRequestBodyAccess On
SecResponseBodyAccess On
SecResponseBodyLimitAction ProcessPartial
SecResponseBodyMimeType text/xml

<FilesMatch "xmlrpc.php">
    # Block brute force attempts using xmlrpc.php as the vector
    # Increment our counter when the xmlrpc API indicates a failure
    SecRule REQUEST_BODY "wp\.getUsersBlogs" "id:13504,deny,chain,status:406,\
        phase:4,t:none,t:urlDecode,chain,deny,\
        msg:'xmlrpc.php call failures triggered temporary block'"
    SecRule RESOURCE:xmlrpc_bf_block "@gt 0"

    SecRule RESPONSE_BODY "faultString" "id:13505,nolog,\
        phase:4,t:none,t:urlDecode,\
        setvar:RESOURCE.xmlrpc_bf_counter=+1,\
        deprecatevar:RESOURCE.xmlrpc_bf_counter=1/300"

    SecRule RESOURCE:xmlrpc_bf_counter "@gt 2" "id:13506,nolog,\
        setvar:RESOURCE.xmlrpc_bf_block=1,\
        expirevar:RESOURCE.xmlrpc_bf_block=900,\
        setvar:RESOURCE.xmlrpc_bf_counter=0"
</FilesMatch>