diff --git a/src/deb/for-download/tools/rate-limit-tpl/force-https-firewall-wordpress.stpl b/src/deb/for-download/tools/rate-limit-tpl/force-https-firewall-wordpress.stpl
index e8b5b2288..b263d6b50 100644
--- a/src/deb/for-download/tools/rate-limit-tpl/force-https-firewall-wordpress.stpl
+++ b/src/deb/for-download/tools/rate-limit-tpl/force-https-firewall-wordpress.stpl
@@ -79,6 +79,8 @@ server {
         proxy_pass      https://%ip%:%web_ssl_port%;
     }
 
+    location ~ /wp-config.php    {return 404;}
+    location ~ /xmlrpc.php       {return 404;}
     location ~ /\.ht    {return 404;}
     location ~ /\.env   {return 404;}
     location ~ /\.svn/  {return 404;}
diff --git a/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.stpl b/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.stpl
index e8b5b2288..b263d6b50 100644
--- a/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.stpl
+++ b/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.stpl
@@ -79,6 +79,8 @@ server {
         proxy_pass      https://%ip%:%web_ssl_port%;
     }
 
+    location ~ /wp-config.php    {return 404;}
+    location ~ /xmlrpc.php       {return 404;}
     location ~ /\.ht    {return 404;}
     location ~ /\.env   {return 404;}
     location ~ /\.svn/  {return 404;}
diff --git a/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.tpl b/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.tpl
index 49da9387d..7203b88cb 100644
--- a/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.tpl
+++ b/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.tpl
@@ -76,6 +76,8 @@ server {
         proxy_pass      http://%ip%:%web_port%;
     }
 
+    location ~ /wp-config.php    {return 404;}
+    location ~ /xmlrpc.php       {return 404;}
     location ~ /\.ht    {return 404;}
     location ~ /\.env   {return 404;}
     location ~ /\.svn/  {return 404;}