WordPress Setup

Jan 08, 2025

Ariffud M.

4min Read

xmlrpc.php in WordPress: What is it and why disable It

xmlrpc.php in WordPress: What is it and why disable It

WordPress has always included features that allow you to interact with your site remotely. For a long time, the solution was a file called xmlrpc.php. However, in recent years, the file has become more of a problem than a solution.

We’ll look at what xmlrpc.php is and why it was written. We also go over the most common security issues it causes and how to fix them on your own WordPress site.

What is xmlrpc.php in WordPress?

XML-RPC is a feature of WordPress that enables data to be transmitted, with HTTP acting as the transport mechanism and XML as the encoding mechanism. Since WordPress isn’t a self-enclosed system and occasionally needs to communicate with other systems, this was used to handle that job.

The core features that xmlrpc.php enabled were connecting to your site via smartphone, implementing trackbacks and pingbacks from other sites, and some functions associated with the Jetpack plugin.

Let’s say you wanted to post to your WordPress site from your mobile device. You could use the remote access feature enabled by xmlrpc.php to do just that.

Why was xmlrpc.php created and how was it used

The use of XML-RPC dates back to the early days of WordPress, before it was even called WordPress.

Writing and publishing on the internet were much more difficult and time-consuming in the early days of the internet when connections were incredibly slow. At the time, the solution was to create an offline blogging client where you could compose your content before connecting to your blog to publish it. This connection was established using XML-RPC.

XML-RPC was initially disabled by default until WordPress 2.6 added a feature in the dashboard to enable or disable it. Then, XML-RPC was enabled by default with WordPress 3.5 and the introduction of the WordPress mobile app. The option to enable or disable XML-RPC from the dashboard was also removed.

XML-RPC nowadays

In 2015, WordPress core introduced a new REST API for interacting with mobile applications and other platforms. Many developers began to use the new REST API instead, which effectively replaced XML-RPC.

However, XML-RPC is still enabled in WordPress, and the xmlrpc.php file is still located in the core software directory.

Suggested reading

Learn more about WordPress REST API and how to start using it for WordPress development.

Why you should disable xmlrpc.php

The biggest problem with XML-RPC is the security concern that arises. The issue isn’t with XML-RPC in itself but instead with how the file can be abused to launch cyberattacks on your site.

The first is using brute-force attacks to gain entry to your site. An attacker will try to access your site using xmlrpc.php by using various username and password combinations. They can effectively use a single command to test hundreds of different passwords, allowing them to bypass security tools that typically detect and block brute-force attacks.

The second is taking sites offline through a DDoS attack. Hackers would use the pingback feature in WordPress to send pingbacks to thousands of sites instantaneously. This feature in xmlrpc.php gives hackers a nearly endless supply of IP addresses over which to distribute a DDoS attack.

Pro tip

Various threats pose risks to your website’s security. Safeguarding your website against potential vulnerabilities can be achieved by choosing a dependable WordPress hosting provider. Ensure your website’s protection by selecting a secure WordPress host that implements advanced security measures.

So, in addition to protecting yourself with strong passwords and WordPress security plugins, it’s best to disable xmlrpc.php.

To check if XML-RPC is running on your site, run it through a tool called XML-RPC Validator. If you get an error message, then it means you don’t have XML-RPC enabled. But if you get a success message, it’s highly recommended that you disable xmlrpc.php.

How to disable xmlrpc.php in WordPress

Let’s go over the two ways to disable xmlrpc.php in WordPress.

1. Disabling xmlrpc.php with a plugin

With a plugin, disabling XML-RPC on your WordPress site is simple.

Simply navigate to the Plugins → Add New section from within your WordPress dashboard. Search for Disable XML-RPC-API and install it. Once you activate the plugin, it will automatically apply the necessary code to turn off XML-RPC.

Keep in mind that other existing plugins may utilize parts of XML-RPC, so disabling it completely could cause a plugin conflict or certain elements of your site to no longer function.

2. Disabling xmlrpc.php manually

If you prefer to delete xmlrpc.php manually, follow this method which will stop all incoming xmlrpc.php requests before they get passed onto WordPress.

Access your .htaccess file through your hosting control panel’s File Manager or an FTP client. You may have to turn on the Show hidden files option to make this file visible. Inside your .htaccess file, paste the following code:

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx
</Files>

Important! Change xxx.xxx.xxx.xxx to IP address you wish to allow access xmlrpc.php or remove this line completely.

Conclusion

XML-RPC was a solid remote publishing tool for your WordPress site. However, it came with some security holes that ended up being pretty damaging for some WordPress site owners.

To ensure your site remains secure, it’s highly recommended to disable xmlrpc.php entirely by using a plugin or manually editing the .htaccess file.

Learn more about WordPress


How to use XAMPP in WordPress
WordPress tutorial
Best WordPress frameworks
What is the WordPress Heartbeat API
How to add custom CSS to WordPress

Author
The author

Ariffud Muhammad

Ariffud is a Technical Content Writer with an educational background in Informatics. He has extensive expertise in Linux and VPS, authoring over 200 articles on server management and web development. Follow him on LinkedIn.

More from Ariffud Muhammad