XML-RPC is one of those WordPress features most business owners have never heard of — but hackers know it extremely well. It's a frequent target for brute-force attacks and DDoS amplification.
What Is XML-RPC?
XML-RPC (xmlrpc.php) is a protocol allowing external applications to communicate with WordPress remotely. Originally built for desktop blogging tools and the WordPress mobile app. It accepts authenticated requests to perform almost any WordPress action.
Why Is It a Security Risk?
Brute-force amplification: XML-RPC allows testing hundreds of username/password combinations in a single HTTP request via system.multicall. Attackers can try thousands of passwords with a single request — far more efficient than the login page. DDoS amplification: The pingback.ping method can use your site to attack other sites without your knowledge, making your business an unwitting participant in cybercrime.
Who Actually Needs It?
Very few businesses. You need it only if you: use the WordPress mobile app via XML-RPC (modern versions use the REST API instead), use desktop blogging clients like MarsEdit, or have a specific custom application requiring it. When in doubt, disable it for a week and see if anything breaks.
How to Disable XML-RPC
Security plugin: One checkbox in Wordfence or similar security plugin. Easiest. .htaccess (Apache): Add: <Files xmlrpc.php> Deny from all </Files> Nginx config: Add: location = /xmlrpc.php { deny all; } WordPress filter: Add to functions.php: add_filter('xmlrpc_enabled', '__return_false');
What About the REST API?
Do NOT disable the WordPress REST API. It's required by the Gutenberg editor, Jetpack, and many plugins. The REST API is a modern, more secure replacement for XML-RPC — disable XML-RPC, keep the REST API.
Need help with your WordPress site?
Fast Web Experts provides WordPress maintenance, security, speed, and expert support for small businesses. Start with a free audit — results in 24 hours.
Get a free WordPress site audit →