XML-RPC enabled
Effort to fix: Quick win (under an hour)
Why it matters
xmlrpc.php lets bots try hundreds of passwords in one request and can be abused for pingback DDoS.
How to fix it
Disable XML-RPC unless you use Jetpack or the mobile app, or restrict it to known IPs.
On WordPress
Block /xmlrpc.php at the server/CDN, or add add_filter('xmlrpc_enabled', '__return_false'); in a must-use plugin (the server block is stronger).