WHM >
Apache Configuration > Include Editor > Pre VirtualHost Include
<LocationMatch "wp-cron\.php$">
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</LocationMatch>
or, run below command in ssh
echo '<LocationMatch "wp-cron\.php$">
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</LocationMatch>
# Block WordPress xmlrpc.php Globally
<FilesMatch "xmlrpc\.php">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</FilesMatch>' >> /etc/apache2/conf.d/includes/pre_main_global.conf
httpd -k restart
