Not quite but you're on the right track.

To add a rule you use --add-rule:

# firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 10 -p tcp --dport 22 -j ACCEPT
success

To see current rules use --get-all-rules:

# firewall-cmd --direct --get-all-rules
ipv4 filter INPUT_direct 10 -p tcp --dport 22 -j ACCEPT

To remove a rule use --remove-rule:

# firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 10 -p tcp --dport 22 -j ACCEPT
success

If you have multiple rules, then change the prio to order them. I have used 10 here.

The above commands only affect the current state of the firewall. Run again with --permanent to make the changes persist in firewalld config.

Create a new chain and place the rules in the chain. These are all valid syntax though I don't have WordPress setup to test them:

firewall-cmd --direct --add-chain ipv4 filter IN_xmlrpc
firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 10 -p tcp --dport 80 -j IN_xmlrpc
firewall-cmd --direct --add-rule ipv4 filter IN_xmlrpc 10 -p tcp --syn -m recent --set
firewall-cmd --direct --add-rule ipv4 filter IN_xmlrpc 20 -p tcp --tcp-flags PSH,SYN,ACK ACK -m recent --update
firewall-cmd --direct --add-rule ipv4 filter IN_xmlrpc 30 -p tcp --tcp-flags PSH,ACK PSH,ACK -m recent --remove -m string --to 70 --algo bm --string "POST /xmlrpc.php" -j DROP

However, the link you reference seems more like marketing material to me. The post describes a method to block a specific type of DDoS attack so you can get access to your WordPress instance and install the author's company's application firewall product. Unless you just happen to be suffering the exact same type of DDoS attack, which they will have artificially generated, just doing this alone may not provide a great deal of real-world protection for your blog. You would probably have a full time job sitting there writing iptables rules to block real known web application attacks. At small scale perhaps it makes sense to invest in an application-level firewall or even a network firewall appliance which can do this. At large enough scale it probably makes more sense to outsource this to a CDN who do adaptive DDoS protection (Akamai, CloudFlare, Level3, etc) so you don't even need to worry about it.