XML-RPC in WordPress: what it is and whether to switch it off

WordPress & CMS·· 19 views· 2 min read

The short answer: xmlrpc.php is an old WordPress file that lets outside programs publish to your site. Most sites no longer need it, and bots love it for guessing passwords. If you do not use an app that depends on it, you can block it; if you do, leave it as it is.

Do you need it?

If you use… Do you need XML-RPC?
Only the WordPress dashboard, in the browser No. The dashboard does not use it.
The WordPress mobile app, on older sites You might, depending on the version. Test after blocking.
Plugins that connect the site to an outside service Some do (check the plugin’s documentation). Test after blocking.
Publishing from an office program or an external editor Older ones do; newer ones use another route.
None of the above You can block it. One door less left open.

Blocking it, step by step

1 Take a copy of the .htaccess file in the site folder: What to back up before you update.
2 Pick a route. The simplest is a security plugin with a “disable XML-RPC” option. The other is to add these lines to .htaccess: <Files xmlrpc.php>
Require all denied
</Files>
3 Open the address your-domain.com/xmlrpc.php. If blocked, you should see “403 Forbidden” (or the equivalent); before, it said “XML-RPC server accepts POST requests only”.
4 Test what you use: publish a test post and confirm the apps connected to the site still work. If one fails, take the lines out of .htaccess.
5 If the site gave a 500 error after saving .htaccess, go back to the copy: Error 500.
Blocking XML-RPC does not replace the rest of the protection. Keep a strong password, a captcha and the login attempt limit: Protecting the WordPress login. It is one piece, not the whole defence.
A burst of requests to xmlrpc.php with nobody using it is a sign of attack: DDoS attack or just a traffic spike.

Not sure whether your site needs it? Open a ticket with the address and the names of your plugins.

Open a support ticket

SEE ALSO

Protecting the WordPress login: three steps in order of effect

ModSecurity and web application firewalls: what they do, and what to do when one blocks you

Installing WordPress plugins: where, which ones, and how many

RECOMMENDED PRODUCT

WordPress hosting

One-click install, updates handled, and speed that holds up. from $5.36/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

WordPress & CMS 224 How to install WordPress in a few clicks You don't have to download WordPress, create a database and upload files by hand. The installer in cPanel does all of it...
WordPress & CMS 185 Common WordPress errors: white screen, critical error and how to find the cause The site stopped opening and shows a blank white screen, or the line «There has been a critical error on this website»....
WordPress & CMS 148 Cannot get into the WordPress dashboard: the six usual causes The site opens, but the admin dashboard does not. Either it asks for the password in an endless loop, or it says the det...
WordPress & CMS 233 How to remove WordPress from a domain, without leaving anything behind You want WordPress off a domain, because the installation broke, because you are starting over, or because the site is b...
WordPress & CMS 245 Protecting the WordPress login: three steps in order of effect WordPress’s login address is the same on every site in the world: /wp-admin and /wp-login.php. That means any automated...
WordPress & CMS 15 Importing a theme’s demo content without wrecking your site The short answer: many themes come with an “Import demo” button that copies the example’s pages, images and menus into y...