Restrict access to xmlrpc.php

There are plugins for that: e.g. http://wordpress.org/plugins/disable-xml-rpc/

You can also write a filter yourself

add_filter('xmlrpc_enabled', '__return_false');

You can simply add this code your theme functions.php (located in wp-content/themes/your_theme).

However, you are advised to create a child theme (http://codex.wordpress.org/Theme_Development) so that your modification does not disappear when you update the theme.

Alternatively, you can create your plugin (http://codex.wordpress.org/Writing_a_Plugin) where you will put all your WordPress tweaking.

I also add the following for a better protection:

/**
 * Secure WordPress by removing version
 */
remove_action('wp_head', 'wp_generator');


/**
 * Secure WordPress by hiding login errors
 */
function hide_login_errors($errors) { return 'login error'; }
add_filter('login_errors', 'hide_login_errors', 10, 1);