Why You Must Disable XML-RPC Immediately

If you review the access logs of any active WordPress server, you will see a constant stream of POST requests hitting a file called xmlrpc.php. For 99% of WordPress sites, this file serves absolutely no purpose, yet it remains one of the largest security liabilities in the ecosystem.

This technical guide explains exactly what XML-RPC is, how botnets exploit it for brute-force and DDoS attacks, and the definitive methods to disable it permanently at the server level.

1. What is XML-RPC?

XML-RPC (XML Remote Procedure Call) is an API specification that was introduced in the very early days of WordPress (long before the modern REST API existed). It was designed to allow external applications (like the WordPress mobile app or third-party blogging clients like Windows Live Writer) to communicate with your WordPress site.

Through XML-RPC, an external app can create posts, edit comments, and upload media without using a web browser.

2. The Vulnerability: system.multicall Amplification

The primary reason XML-RPC is so dangerous today is a feature called system.multicall. This method allows an application to execute multiple commands within a single HTTP request to save bandwidth.

However, cybercriminals realized they could exploit this to supercharge brute-force attacks. Instead of sending one HTTP request per password guess (which triggers rate-limiters and Fail2Ban), a botnet can send a single XML-RPC request containing hundreds or thousands of password guesses.

<methodCall>
  <methodName>system.multicall</methodName>
  <params>
    <param><value><array><data>
      <!-- Guess 1 -->
      <value><struct>
        <member><name>methodName</name><value>wp.getUsersBlogs</value></member>
        <member><name>params</name><value><array><data>
          <value>admin</value><value>Password123!</value>
        </data></array></value></member>
      </struct></value>
      <!-- Guess 2... up to 1000s -->
    </data></array></value></param>
  </params>
</methodCall>

This allows an attacker to test millions of passwords rapidly, entirely bypassing standard login protection mechanisms.

3. The DDoS Vector (Pingback Attacks)

XML-RPC is also used for "Pingbacks" (a feature that notifies a blog when someone links to them). Hackers exploit the pingback.ping method to turn your WordPress site into a weapon.

By sending an XML-RPC request to your site instructing it to ping a target website, the hacker forces your server to make an HTTP request to the victim. When coordinated across thousands of WordPress sites, this creates a massive Layer 7 Distributed Denial of Service (DDoS) attack that can take down major infrastructure, all while masking the hacker's true IP address.

4. How to Disable XML-RPC Permanently

Because the vulnerability lies in how the server processes the file, the most effective way to disable XML-RPC is at the web-server level. Plugins that disable XML-RPC via PHP still require WordPress to load, which consumes CPU resources during an attack.

Method A: Apache (.htaccess)

Add the following directive to your .htaccess file to deny all access to the file:

<Files xmlrpc.php>
    Order deny,allow
    Deny from all
</Files>

Method B: NGINX (nginx.conf)

If you use NGINX, add this location block to your server configuration to instantly drop the request:

location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

5. What if I actually need XML-RPC?

If you absolutely must use the WordPress mobile app or Jetpack (which rely on XML-RPC), you cannot block the file entirely. Instead, you must restrict access to specific, trusted IP addresses.

For example, you can whitelist the Jetpack IP ranges in your .htaccess while denying everyone else. However, a much better modern alternative is to utilize the secure REST API, which supports standard authentication protocols like OAuth and is heavily rate-limited by WAFs.

6. Automated Protection via Nexura Security

If modifying server configuration files makes you uncomfortable, Nexura Security Pro automatically handles this for you.

Upon activation, Nexura hooks into the early execution phase and instantly blocks all XML-RPC requests containing system.multicall or pingback.ping. Furthermore, Nexura automatically blocks the IP addresses of any botnet attempting to abuse the endpoint, protecting your CPU limits and bandwidth.

Conclusion

XML-RPC is a legacy technology that introduces catastrophic security risks to modern WordPress deployments. Unless you have a specific, unavoidable business requirement for it, disabling xmlrpc.php is a mandatory step in securing your infrastructure against automated botnets and amplification attacks.