What it is

xmlrpc.php is enabled. It's an old WordPress API that's routinely abused for amplified brute-force login attempts (many password guesses hidden inside few requests) and for pingback-based DDoS attacks against other sites.

How to fix it

Disable xmlrpc.php if you don't use it (most sites don't) — the WordPress Plugin's Security tab can block it for you.

In depth

Your WordPress site has an old communication tool called XML-RPC that is turned on and can be reached from the internet. This tool was useful years ago but is rarely needed by modern websites, and hackers specifically look for it because it lets them try thousands of password guesses very quickly or use your site to attack other websites without being easily detected. The risk is real because attackers actively scan for this vulnerability and will exploit it if they find it. Fixing this is simple and takes just a few minutes: you can use a security plugin like Wordfence or All In One WP Security, go to its settings, find the section about XML-RPC or external access, and click the button to disable or block it. If you're not sure whether you actually use this feature, you almost certainly don't, since modern plugins and apps use different methods to communicate with WordPress. Once you disable it, your site becomes a much harder target for automated attacks.