xmlrpc.php should be disabled in Wordpress except if specific use case.
In .htaccess file:

Block WordPress xmlrpc.php requests

<Files xmlrpc.php>
order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx
</Files>