<!DOCTYPE html>
<html class="client-nojs vector-feature-night-mode-disabled vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-sticky-header-enabled" lang="en" dir="ltr"><head>
<meta charset="UTF-8">
<title>Pingback</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="canonical" href="https://en.wikipedia.org/wiki/Pingback"> <link href="./mw/ext.cite.styles.css" rel="stylesheet" type="text/css">
<link href="./mw/skins.vector.icons.css" rel="stylesheet" type="text/css">
<link href="./mw/skins.vector.search.codex.styles.css" rel="stylesheet" type="text/css">
<link href="./mw/skins.vector.styles.css" rel="stylesheet" type="text/css">
<link href="./mw/user.styles.css" rel="stylesheet" type="text/css">
<meta name="ResourceLoaderDynamicStyles" content="">
<link rel="stylesheet" type="text/css" href="./mw/site.styles.css">
<link rel="stylesheet" type="text/css" href="./mw/noscript.css">
<link rel="stylesheet" type="text/css" href="./footer.css">
<link rel="stylesheet" type="text/css" href="./vector-2022.css">
</head>
<body class="skin--responsive skin-vector skin-vector-search-vue mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Pingback rootpage-Pingback skin-vector-2022 action-view">
<div class="mw-page-container">
<div class="mw-page-container-inner">
<div class="mw-content-container">
<main id="content" class="mw-body">
<header class="mw-body-header vector-page-titlebar">
<h1 id="firstHeading" class="firstHeading mw-first-heading">
<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Pingback</span></span>
</h1>
</header>
<a id="top"></a>
<div id="bodyContent" class="vector-body ve-init-mw-desktopArticleTarget-targetContainer" aria-labelledby="firstHeading" data-mw-ve-target-container="">
<div id="mw-content-text" class="mw-body-content mw-content-ltr" lang="en" dir="ltr"><div class="mw-content-ltr mw-parser-output" lang="en" dir="ltr">
<p>A <b>pingback</b> is one of four types of <a href="Linkback" title="Linkback">linkback</a> methods for <a href="World_Wide_Web" title="World Wide Web">Web</a> authors to request notification when somebody <a href="Hyperlink" title="Hyperlink">links</a> to one of their documents. This enables authors to keep track of who is linking to, or referring to their articles. Some <a href="Weblog" class="mw-redirect" title="Weblog">weblog</a> software and <a href="Content_management_systems" class="mw-redirect" title="Content management systems">content management systems</a>, such as <a href="WordPress" title="WordPress">WordPress</a>, <a href="Movable_Type" title="Movable Type">Movable Type</a>, <a href="Serendipity_(software)" title="Serendipity (software)">Serendipity</a>, and <a href="Telligent_Community" title="Telligent Community">Telligent Community</a>, support automatic pingbacks where all the links in a published article can be <a href="Ping_(blogging)" title="Ping (blogging)">pinged</a> when the article is published. Other content management systems, such as <a href="Drupal" title="Drupal">Drupal</a> and <a href="Joomla" title="Joomla">Joomla</a>, support pingbacks through the use of addons or extensions.
</p><p>Essentially, a pingback is an <a href="XML-RPC" title="XML-RPC">XML-RPC</a> request (not to be confused with an ICMP <a href="Ping_(networking_utility)" title="Ping (networking utility)">ping</a>) sent from Site A to Site B, when an author of the blog at Site A writes a post that links to Site B. The request includes the <a href="URI" class="mw-redirect" title="URI">URI</a> of the linking page. When Site B receives the notification signal, it automatically goes back to Site A checking for the existence of a live incoming link. If that link exists, the pingback is recorded successfully. This makes pingbacks less prone to <a href="Spam_(electronic)" class="mw-redirect" title="Spam (electronic)">spam</a> than <a href="Trackback" title="Trackback">trackbacks</a>. Pingback-enabled resources must either use an X-Pingback <a href="Header_(computing)" title="Header (computing)">header</a> or contain a <code><link></code> element to the XML-RPC script.
</p>
<meta property="mw:PageProp/toc">
<div class="mw-heading mw-heading2"><h2 id="History">History</h2></div>
<p>The Pingback specification was developed in 2002 by <a href="Stuart_Langridge" title="Stuart Langridge">Stuart Langridge</a>, Simon Willison, and <a href="Ian_Hickson" title="Ian Hickson">Ian Hickson</a>.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup>
</p>
<div class="mw-heading mw-heading2"><h2 id="Exploits">Exploits</h2></div>
<p>In March 2014, <a href="Akamai" class="mw-redirect" title="Akamai">Akamai</a> published a report about a widely seen exploit involving pingback that targets vulnerable <a href="WordPress" title="WordPress">WordPress</a> sites.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup> This exploit led to massive abuse of legitimate blogs and websites and turned them into unwilling participants in a <a href="DDoS" class="mw-redirect" title="DDoS">DDoS</a> attack.<sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup> Details about this vulnerability have been publicized since 2012,<sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup> with <a href="Akismet" title="Akismet">Akismet</a> reporting in 2013 that "almost 100% of trackbacks and pingbacks are spam".<sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup>
</p><p>The pingback attacks consist of "reflection" and "amplification": an attacker sends a pingback to a legitimate Blog A, but providing information of the legitimate Blog B (<a href="Impersonation" class="mw-redirect" title="Impersonation">impersonation</a>).<sup id="cite_ref-A10_2016_10-0" class="reference"><a href="#cite_note-A10_2016-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> Then, Blog A needs to check Blog B for the existence of the informed link, as it's how the pingback protocol works, and thus it downloads the page off Blog B server's, causing a <i>reflection</i>.<sup id="cite_ref-A10_2016_10-1" class="reference"><a href="#cite_note-A10_2016-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> If the target page is big, this <i>amplifies</i> the attack, because a small request sent to Blog A causes it to make a big request to Blog B.<sup id="cite_ref-A10_2016_10-2" class="reference"><a href="#cite_note-A10_2016-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> This can lead to 10x, 20x, and even bigger amplifications (<a href="DoS" class="mw-redirect" title="DoS">DoS</a>).<sup id="cite_ref-A10_2016_10-3" class="reference"><a href="#cite_note-A10_2016-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> It's even possible to use multiple reflectors, to prevent exhausting each of them, and use the combined amplification power of each to exhaust the target Blog B, being by overloading bandwidth or the server CPU (<a href="DDoS" class="mw-redirect" title="DDoS">DDoS</a>).<sup id="cite_ref-A10_2016_10-4" class="reference"><a href="#cite_note-A10_2016-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup>
</p><p>WordPress changed a bit how the pingback feature works to mitigate this kind of vulnerability: the IP address that originated the pingback (the attacker address) started being recorded, and thus shown in the log.<sup id="cite_ref-Sucuri_2016_11-0" class="reference"><a href="#cite_note-Sucuri_2016-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup> Notwithstanding, in 2016, pingback attacks continued to exist, supposedly because the website owners don't check the user agent logs, that have the real IP addresses.<sup id="cite_ref-Sucuri_2016_11-1" class="reference"><a href="#cite_note-Sucuri_2016-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-A10_2016_10-5" class="reference"><a href="#cite_note-A10_2016-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> If the attacker is more than a <a href="Script_kiddie" title="Script kiddie">script kiddie</a>, they will know how to prevent their IP address being recorded, by, for example, sending the request from another machine/site, so that this machine/site IP address is recorded instead, and the IP logging then, becomes less worthy.<sup id="cite_ref-Conetix_2016_12-0" class="reference"><a href="#cite_note-Conetix_2016-12"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup> Thus, it's still recommended to disable the pingbacks, to prevent attacking other sites (although this does not prevent being target of attacks).<sup id="cite_ref-Sucuri_2016_11-2" class="reference"><a href="#cite_note-Sucuri_2016-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup>
</p>
<div class="mw-heading mw-heading2"><h2 id="See_also">See also</h2></div>
<ul><li><a href="Weblogs.com" title="Weblogs.com">Weblogs.com</a>, an earlier XML-RPC interface for weblogs to send pingbacks.</li>
<li><a href="Webmention" title="Webmention">Webmention</a>, a modern re-implementation of Pingback using HTTP and x-www-urlencoded POST data.</li>
<li><a href="Linkback" title="Linkback">Linkback</a>, the suite of protocols that allows websites to manually and automatically link to one another.</li>
<li><a href="Refback" title="Refback">Refback</a>, a similar protocol but easier than pingbacks since the site originating the link doesn't have to be capable of sending a pingback.</li>
<li><a href="Trackback" title="Trackback">Trackback</a>, a similar protocol but more prone to spam.</li>
<li><a href="Search_engine_optimization" title="Search engine optimization">Search engine optimization</a></li></ul>
<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>
<style data-mw-deduplicate="TemplateStyles:r1239543626">
/* start https://en.wikipedia.org/ */
.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}
/* end https://en.wikipedia.org/ */
</style><div class="reflist">
<div class="mw-references-wrap mw-references-columns"><ol class="references">
<li id="cite_note-1"><span class="mw-cite-backlink"><b><a href="#cite_ref-1">^</a></b></span> <span class="reference-text"><style data-mw-deduplicate="TemplateStyles:r1238218222">
/* start https://en.wikipedia.org/ */
.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}
/* end https://en.wikipedia.org/ */
</style><cite id="CITEREFLangridge2002" class="citation web cs1">Langridge, Stuart (7 July 2002). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20021222230146/http://www.kryogenix.org/days/000138.cas">"Making TrackBack happen automatically"</a>. Archived from <a rel="nofollow" class="external text" href="http://www.kryogenix.org/days/000138.cas">the original</a> on 2002-12-22<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-31</span></span>.</cite></span>
</li>
<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite id="CITEREFWillison2002" class="citation web cs1">Willison, Simon (2 September 2002). <a rel="nofollow" class="external text" href="http://simonwillison.net/2002/Sep/2/pingBackImplemented/">"Pingback implemented"</a>. <i>simonwillison.net</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-31</span></span>.</cite></span>
</li>
<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><cite id="CITEREFHickson2002" class="citation web cs1">Hickson, Ian (2002-09-23). <a rel="nofollow" class="external text" href="http://ln.hixie.ch/?start=1032794857&count=1">"Hixie's Natural Log: Pingback 1.0"</a>. <i>ln.hixie.ch</i>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20021206184812/http://ln.hixie.ch/?start=1032794857&count=1">Archived</a> from the original on 2002-12-06<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-31</span></span>.</cite></span>
</li>
<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://simonwillison.net/2002/Sep/24/pingback10/">"Pingback 1.0"</a>. <i>simonwillison.net</i>. 2002-09-24. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20030826071601/http://simon.incutio.com/archive/2002/09/24/pingback10">Archived</a> from the original on 2003-08-26<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-31</span></span>.</cite></span>
</li>
<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="http://www.hixie.ch/specs/pingback/pingback-1.0">"Pingback 1.0"</a>. <i>www.hixie.ch</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-31</span></span>.</cite></span>
</li>
<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite id="CITEREFBrenner" class="citation web cs1">Brenner, Bill. <a rel="nofollow" class="external text" href="https://blogs.akamai.com/2014/03/anatomy-of-wordpress-xml-rpc-pingback-attacks.html">"Anatomy of Wordpress XML-RPC Pingback Attacks"</a>. <i>The Akamai Blog, March 31, 2014 5:42 AM</i><span class="reference-accessdate">. Retrieved <span class="nowrap">July 7,</span> 2014</span>.</cite></span>
</li>
<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><cite id="CITEREFCid2014" class="citation web cs1">Cid, Daniel (10 March 2014). <a rel="nofollow" class="external text" href="http://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-distributed-denial-of-service-attack.html">"More Than 162,000 WordPress Sites Used for Distributed Denial of Service Attack"</a>. <i>Sucuri Blog, March 10, 2014</i><span class="reference-accessdate">. Retrieved <span class="nowrap">July 7,</span> 2014</span>.</cite></span>
</li>
<li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><cite id="CITEREFCalin2012" class="citation web cs1">Calin, Bogdan (17 December 2012). <a rel="nofollow" class="external text" href="http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/">"WordPress Pingback Vulnerability"</a>. <i>Accunetix, December 17, 2012 - 01:17pm</i><span class="reference-accessdate">. Retrieved <span class="nowrap">July 7,</span> 2014</span>.</cite></span>
</li>
<li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><cite id="CITEREFSusan_Richards2013" class="citation web cs1">Susan Richards (2013-05-21). <a rel="nofollow" class="external text" href="https://piedtype.com/2013/05/21/spammers-use-trackbacks-pingbacks-and-reblogs/">"Spammers use trackbacks, pingbacks, and reblogs"</a>. <i>PIED TYPE</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-31</span></span>.</cite></span>
</li>
<li id="cite_note-A10_2016-10"><span class="mw-cite-backlink">^ <a href="#cite_ref-A10_2016_10-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-A10_2016_10-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-A10_2016_10-2"><sup><i><b>c</b></i></sup></a> <a href="#cite_ref-A10_2016_10-3"><sup><i><b>d</b></i></sup></a> <a href="#cite_ref-A10_2016_10-4"><sup><i><b>e</b></i></sup></a> <a href="#cite_ref-A10_2016_10-5"><sup><i><b>f</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFKrassi_Tzvetanov2016" class="citation web cs1">Krassi Tzvetanov (May 4, 2016). <a rel="nofollow" class="external text" href="https://www.a10networks.com/blog/wordpress-pingback-attack">"WordPress pingback attack"</a>. <i>A10 Networks</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2 February</span> 2017</span>. <q>This issue arises from the fact that it is possible for an attacker A to impersonate T's blog by connecting to R's blog and sending a link notification that specifies T's blog as the origination of the notification. At that point, K will automatically attempt to connect to T to download the blog post. This is called reflection. If the attacker were careful to select a URL that has a lot of information in it, this would cause amplification. In other words, for a relatively small request from the attacker (A) to the reflector, the reflector (R) will connect to the target (T) and cause a large amount of traffic. [...] On the reflector side for the 200-byte request, the response can easily be thousands of bytes – resulting in a multiplication that starts in the 10x, 20x and more. [...] To avoid overloading the reflector, multiple reflectors can be employed to scale up. Thus, the target will have their outgoing bandwidth, and possibly compute resources, exhausted. [...] Another point to consider is the compute resources tied to the target side. If considering a page that is computationally expensive to produce, it may be more efficient for the attacker to overload the CPU of a system versus the bandwidth of the connection. [...] This is not the first time a CMS, and in particular WordPress, has been used for DDoS or other malicious activity. To a very large extent, this is because WordPress appeals to users that do not have the resources to manage their websites and they often use WordPress to make their job easier. As a result, many users do not have an adequate patch management program or proper monitoring to observe irregularities in their traffic.</q></cite></span>
</li>
<li id="cite_note-Sucuri_2016-11"><span class="mw-cite-backlink">^ <a href="#cite_ref-Sucuri_2016_11-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Sucuri_2016_11-1"><sup><i><b>b</b></i></sup></a> <a href="#cite_ref-Sucuri_2016_11-2"><sup><i><b>c</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFDaniel_Cid2016" class="citation web cs1">Daniel Cid (February 17, 2016). <a rel="nofollow" class="external text" href="https://blog.sucuri.net/2016/02/wordpress-sites-leveraged-in-ddos-campaigns.html">"WordPress Sites Leveraged in Layer 7 DDoS Campaigns"</a>. <i>Sucuri</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2 February</span> 2017</span>. <q>Starting in version 3.9, WordPress started to record the IP address of where the pingback request originated. That diminished the value of using WordPress as part of an attack; the platform would now record the attackers original IP address and it would show up in the log user agent. [...] Despite the potential reduction in value with the IP logging, attackers are still using this technique. Likely because website owners rarely check the user agent logs to derive the real IP address of visitors. [...] Although it is great that WordPress is logging the attacker IP address on newer releases, we still recommend that you disable pingbacks on your site. It won't protect you from being attacked, but will stop your site from attacking others.</q></cite></span>
</li>
<li id="cite_note-Conetix_2016-12"><span class="mw-cite-backlink"><b><a href="#cite_ref-Conetix_2016_12-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFTim_Butler2016" class="citation web cs1">Tim Butler (25 Nov 2016). <a rel="nofollow" class="external text" href="https://www.conetix.com.au/blog/analysis-wordpress-pingback-ddos-attack">"Analysis of a WordPress Pingback DDOS Attack"</a>. <i>Conetix</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2 February</span> 2017</span>. <q>One enhancement WordPress added to the pingbacks in 3.7, which at least tracked the originating IP of the request. While this doesn't solve the problem, it at least allows you to trace where the calls are coming from. Unless the attacker is very, very naive however, this IP will simply trace back to another infected machine or site. Generally these requesting systems are part of a botnet to mask and distribute the requests. [...] The pingback tool within WordPress still remains an exploitable system for any WordPress site which hasn't explicitly stopped it. From a web host's perspective, this is quite frustrating.</q></cite></span>
</li>
</ol></div></div>
<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>
<ul><li><a rel="nofollow" class="external free" href="http://www.hixie.ch/specs/pingback/pingback">http://www.hixie.ch/specs/pingback/pingback</a> - Pingback specification</li></ul>
<div class="navbox-styles"><style data-mw-deduplicate="TemplateStyles:r1129693374">
/* start https://en.wikipedia.org/ */
.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}
/* end https://en.wikipedia.org/ */
</style><style data-mw-deduplicate="TemplateStyles:r1236075235">
/* start https://en.wikipedia.org/ */
.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}
/* end https://en.wikipedia.org/ */
</style></div><div role="navigation" class="navbox" aria-labelledby="Web_syndication243" style="padding:3px"><table class="nowraplinks hlist mw-collapsible mw-collapsed navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><style data-mw-deduplicate="TemplateStyles:r1239400231">
/* start https://en.wikipedia.org/ */
.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}
/* end https://en.wikipedia.org/ */
</style><div id="Web_syndication243" style="font-size:114%;margin:0 4em"><a href="Web_syndication" title="Web syndication">Web syndication</a></div></th></tr><tr><td class="navbox-abovebelow" colspan="2"><div>
<dl><dt>History</dt>
<dd><a href="History_of_blogging" title="History of blogging">Blogging</a></dd>
<dd><a href="History_of_podcasting" title="History of podcasting">Podcasting</a></dd>
<dd><a href="Vlog#History" title="Vlog">Vlogging</a></dd>
<dd><a href="History_of_web_syndication_technology" title="History of web syndication technology">Web syndication technology</a></dd></dl>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Niche_blogging" title="Niche blogging">Types</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><td colspan="2" class="navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Art_blog" title="Art blog">Art</a></li>
<li><a href="Mormon_blogosphere" title="Mormon blogosphere">Bloggernacle</a></li>
<li><a href="Classical_music_blog" title="Classical music blog">Classical music</a></li>
<li><a href="Corporate_blog" title="Corporate blog">Corporate</a></li>
<li><a href="Dream_diary" title="Dream diary">Dream diary</a></li>
<li><a href="Edublog" title="Edublog">Edublog</a></li>
<li><a href="Electronic_journal" class="mw-redirect" title="Electronic journal">Electronic journal</a></li>
<li><a href="Astroturfing" title="Astroturfing">Fake</a></li>
<li><a href="List_of_family-and-homemaking_blogs" title="List of family-and-homemaking blogs">Family</a></li>
<li><a href="Fashion_blog" title="Fashion blog">Fashion</a></li>
<li><a href="Food_blogging" title="Food blogging">Food</a></li>
<li><a href="Health_blog" title="Health blog">Health</a></li>
<li><a href="Blawg" class="mw-redirect" title="Blawg">Law</a></li>
<li><a href="Lifelog" title="Lifelog">Lifelog</a></li>
<li><a href="MP3_blog" title="MP3 blog">MP3</a></li>
<li><a href="Citizen_journalism" title="Citizen journalism">News</a></li>
<li><a href="Photoblog" title="Photoblog">Photoblog</a></li>
<li><a href="Police_blog" title="Police blog">Police</a></li>
<li><a href="Blog#Political_impact" title="Blog">Political</a></li>
<li><a href="Project_diary" title="Project diary">Project</a></li>
<li><a href="Reverse_blog" title="Reverse blog">Reverse</a></li>
<li><a href="Travel_blog" class="mw-redirect" title="Travel blog">Travel</a></li>
<li><a href="Warblog" class="mw-redirect" title="Warblog">Warblog</a></li></ul>
</div></td></tr></tbody></table><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Technology</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><th scope="row" class="navbox-group" style="width:1%">General</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="BitTorrent" title="BitTorrent">BitTorrent</a></li>
<li><a href="Feed_URI_scheme" title="Feed URI scheme">Feed URI scheme</a></li></ul>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Features</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Linkback" title="Linkback">Linkback</a></li>
<li><a href="Permalink" title="Permalink">Permalink</a></li>
<li><a href="Ping_(blogging)" title="Ping (blogging)">Ping</a></li>
<li><a href="Reblogging" title="Reblogging">Reblogging</a></li>
<li><a href="Refback" title="Refback">Refback</a></li>
<li><a href="Rollback_(data_management)" title="Rollback (data management)">Rollback</a></li>
<li><a href="Trackback" title="Trackback">Trackback</a></li></ul>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Mechanism</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Thread_(Internet)" class="mw-redirect" title="Thread (Internet)">Thread</a></li>
<li><a href="Geotagging" title="Geotagging">Geotagging</a></li>
<li><a href="RSS_enclosure" title="RSS enclosure">RSS enclosure</a></li>
<li><a href="FeedSync#Examples" title="FeedSync">Synchronization</a></li></ul>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Memetics" title="Memetics">Memetics</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Atom_(web_standard)" title="Atom (web standard)">Atom feed</a></li>
<li><a href="Data_feed" title="Data feed">Data feed</a></li>
<li><a href="Photofeed" title="Photofeed">Photofeed</a></li>
<li><a href="Product_feed" title="Product feed">Product feed</a></li>
<li><a href="Resource_Description_Framework" title="Resource Description Framework">RDF feed</a></li>
<li><a href="Web_feed" title="Web feed">Web feed</a></li></ul>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="RSS" title="RSS">RSS</a></th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="GeoRSS" title="GeoRSS">GeoRSS</a></li>
<li><a href="Media_RSS" title="Media RSS">MRSS</a></li>
<li><a href="RSS_TV" title="RSS TV">RSS TV</a></li></ul>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Social</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Inter-process_communication" title="Inter-process communication">Inter-process communication</a></li>
<li><a href="Mashup_(web_application_hybrid)" title="Mashup (web application hybrid)">Mashup</a></li>
<li><a href="Reference_(computer_science)" title="Reference (computer science)">Referencing</a></li>
<li><a href="RSS_editor" title="RSS editor">RSS editor</a></li>
<li><a href="RSS_tracking" title="RSS tracking">RSS tracking</a></li>
<li><a href="Streaming_media" title="Streaming media">Streaming media</a></li></ul>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Standard</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="OPML" title="OPML">OPML</a></li>
<li><a href="RSS_Advisory_Board" title="RSS Advisory Board">RSS Advisory Board</a></li>
<li><a href="Usenet" title="Usenet">Usenet</a></li>
<li><a href="World_Wide_Web" title="World Wide Web">World Wide Web</a></li>
<li><a href="XBEL" title="XBEL">XBEL</a></li>
<li><a href="XOXO_(microformat)" title="XOXO (microformat)">XOXO</a></li></ul>
</div></td></tr></tbody></table><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Form</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><td colspan="2" class="navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li>Audio podcast</li>
<li><a href="Enhanced_podcast" class="mw-redirect" title="Enhanced podcast">Enhanced podcast</a></li>
<li><a href="Mobilecast" class="mw-redirect" title="Mobilecast">Mobilecast</a></li>
<li><a href="Narrowcasting" title="Narrowcasting">Narrowcasting</a></li>
<li><a href="Peercasting" title="Peercasting">Peercasting</a></li>
<li><a href="Screencast" title="Screencast">Screencast</a></li>
<li><a href="Slidecasting" class="mw-redirect" title="Slidecasting">Slidecasting</a></li>
<li><a href="Videocast" class="mw-redirect" title="Videocast">Videocast</a></li>
<li><a href="Webcomic" title="Webcomic">Webcomic</a></li>
<li><a href="Webtoon" title="Webtoon">Webtoon</a></li>
<li><a href="Web_series" title="Web series">Web series</a></li></ul>
</div></td></tr><tr><td colspan="2" class="navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Anonymous_blog" title="Anonymous blog">Anonymous blogging</a></li>
<li><a href="Blog#Types" title="Blog">Collaborative blog</a></li>
<li><a href="Columnist" title="Columnist">Columnist</a></li>
<li><a href="Instant_messaging" title="Instant messaging">Instant messaging</a></li>
<li><a href="Liveblogging" title="Liveblogging">Liveblogging</a></li>
<li><a href="Microblogging" title="Microblogging">Microblog</a></li>
<li><a href="Mobile_blogging" title="Mobile blogging">Mobile blogging</a></li>
<li><a href="Spam_blog" title="Spam blog">Spam blog</a></li>
<li><a href="Video_blog" class="mw-redirect" title="Video blog">Video blogging</a></li>
<li><a href="Motovlog" title="Motovlog">Motovlogging</a></li></ul>
</div></td></tr></tbody></table><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Media</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Alternative_media" title="Alternative media">Alternative media</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Blog_carnival" class="mw-redirect" title="Blog carnival">Carnivals</a></li>
<li><a href="Blog_fiction" title="Blog fiction">Fiction</a></li>
<li><a href="Journalism" title="Journalism">Journalism</a>
<ul><li><a href="Citizen_journalism" title="Citizen journalism">Citizen</a></li>
<li><a href="Database_journalism" title="Database journalism">Database</a></li></ul></li>
<li><a href="Online_diary" title="Online diary">Online diary</a></li>
<li><a href="List_of_search_engines#Blog" title="List of search engines">Search engines</a></li>
<li><a href="Sideblog" title="Sideblog">Sideblog</a></li>
<li><a href="Blog" title="Blog">Software</a></li>
<li><a href="Web_directory" title="Web directory">Web directory</a></li></ul>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Micromedia</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Comparison_of_feed_aggregators" title="Comparison of feed aggregators">Aggregation</a>
<ul><li><a href="News_aggregator" title="News aggregator">News</a></li>
<li><a href="Poll_aggregator" title="Poll aggregator">Poll</a></li>
<li><a href="Review_aggregator" title="Review aggregator">Review</a></li>
<li><a href="Search_aggregator" title="Search aggregator">Search</a></li>
<li><a href="Video_aggregator" title="Video aggregator">Video</a></li></ul></li>
<li><a href="Atom_(Web_standard)" class="mw-redirect" title="Atom (Web standard)">Atom</a></li>
<li><a href="Atom_(Web_standard)" class="mw-redirect" title="Atom (Web standard)">AtomPub</a></li>
<li><a href="Broadcatching" title="Broadcatching">Broadcatching</a></li>
<li><a href="Hashtag" title="Hashtag">Hashtag</a></li>
<li><a href="NewsML" class="mw-redirect" title="NewsML">NewsML</a>
<ul><li><a href="NewsML_1" class="mw-redirect" title="NewsML 1">1</a></li>
<li><a href="NewsML-G2" class="mw-redirect" title="NewsML-G2">G2</a></li></ul></li>
<li><a href="Communication" title="Communication">Social communication</a></li>
<li><a href="Social_software" title="Social software">Social software</a></li>
<li><a href="Web_Slice" title="Web Slice">Web Slice</a></li></ul>
</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Related</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em">
<ul><li><a href="Blogosphere" title="Blogosphere">Blogosphere</a></li>
<li><a href="Escribitionist" title="Escribitionist">Escribitionist</a></li>
<li><a href="Glossary_of_blogging" title="Glossary of blogging">Glossary of blogging</a></li>
<li><a href="Pay-per-click" title="Pay-per-click">Pay per click</a></li>
<li><a href="Posting_style" title="Posting style">Posting style</a></li>
<li><a href="Slashdot_effect" title="Slashdot effect">Slashdot effect</a></li>
<li><a href="Spam_in_blogs" title="Spam in blogs">Spam in blogs</a></li>
<li><a href="Uses_of_podcasting" title="Uses of podcasting">Uses of podcasting</a></li></ul>
</div></td></tr></tbody></table><div></div></td></tr></tbody></table></div></div><!--htdig_noindex--><div><div class="zim-footer">
This article is issued from <a class="external text" title="Last edited on 2025-07-23" href="https://en.wikipedia.org/wiki/?title=Pingback&oldid=1302143713">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.
</div>
</div><!--/htdig_noindex--></div>
</div>
</main>
</div>
</div>
</div>
</body></html>