How to Disable XML-RPC in WordPress (And Why You Should)

What is XML-RPC?

XML-RPC (XML Remote Procedure Call) is a feature in WordPress that allows external applications to transmit data to your website. In the early days, this was essential for using the WordPress mobile app or publishing via third-party blogging clients. It is accessed via the xmlrpc.php file in your root directory.

Why is XML-RPC Dangerous?

With the introduction of the WordPress REST API, XML-RPC became largely obsolete. However, it remains enabled by default, creating a massive security hole.

1. Brute Force Attacks Amplification

Normally, a hacker can try one password per login request. With XML-RPC, a hacker can use the system.multicall method to try 500 different passwords in a single HTTP request. This allows them to bypass standard login limiters and brute-force your site with terrifying speed.

2. Pingback DDoS Attacks

Hackers can use the XML-RPC pingback feature to send thousands of simultaneous requests to other websites, effectively turning your server into a weapon used in a Distributed Denial of Service (DDoS) attack.

How to Disable XML-RPC

Method 1: Using Nexura Security

The safest way is using a firewall. In the Nexura Security dashboard, go to the Hardening tab and turn on "Disable XML-RPC". Nexura will block all external requests to this file without breaking internal WordPress processes.

Method 2: Via .htaccess

If you are comfortable editing server files, you can block access to xmlrpc.php at the server level by adding this to your `.htaccess` file:

<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>

Will Disabling It Break My Site?

Unless you are using the Jetpack plugin or a very old mobile publishing app, disabling XML-RPC will have zero negative impact on your website. In fact, you will likely notice a decrease in server CPU usage as malicious bots are blocked instantly.