Securing your site against XML-RPC attacks

What is XML-RPC?

The simple answer is that XML-RPC (short for XML Remote Procedure Call) is a method of allowing remote access to your website.  Specifically to

  • Publish a post
  • Edit a post
  • Delete a post.
  • Upload a new file (e.g. an image for a post)
  • Get a list of comments
  • Edit comments

The service is known as an API (Application Programming Interface) and allows developers of any type to connect their app or service to a WordPress website.

This could include mobile phone apps such as the WordPress app, desktop apps, IoT devices, software services or literally anything that can connect with the internet.

Before the REST API was introduced in WordPress 4.4 XML-RPC was the biggest WordPress API.

Why you may be wanting to deactivate XML-RPC

You may have read somewhere about two large attacks against WordPress websites in 2015 that abused the XML-RPC service.

These were:

  • DDoS via XML-RPC pingbacks.  The attacker tries to flood your website with pingback requests to overload the server.  Again they use the file xmlrpc.php to generate thousands of pingbacks to your website.
  • Brute force attacks via XML-RPC. The attacker tries to guess your login details to get access to your site content. They try to login to WordPress using xmlrpc.php with as many username/password combinations as quickly as possible.

What uses XML-RPC?

XML-RPC has been around for as long as WordPress has.  Being the biggest API lots of apps use it to access to access WordPress sites remotely.  Some are listed below:

  • The official WordPress app for iPhone and Android.
  • Trackbacks and pingbacks when other sites link to yours.
  • Jetpack – one of the most widely used plugins uses it to connect with services such as collecting site visitor data.
  • Likely a whole slew of other things…

So you need to think very carefully before you go ahead and deactivate the service completely. If you do choose to disable XML-RPC at the very minimum the apps and services mentioned above won’t work properly or at all.

How to deactivate XML-RPC

The most efficient way of deactivating the service is to place some code in your top-level .htaccess file.

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
    order deny,allow
    deny from all
    allow from

This denies access to the xmlrpc.php file which is used by the service.

Replace with your own computer’s IP address or remove line 5 to disable XML-RPC for everyone.

If you are not confident or able to update your .htaccess file there are plenty of plugins in the repository which do the same job or use our own Deactivate XML-RPC Service plugin.

Was this article helpful?

Get Your Free Security Fundamentals eBook

Enhance your website security with this free, quick and easy to implement guide.

Keep In Touch


Wil is a dad, WordPress consultant, WordPress developer, business coach and mentor. He co-organizes the WordPress Sydney meetup group and has been on the organising committee for WordCamp Sydney since 2014. He speaks at many special events and contributes to the WordPress open source project. His likes are chillies, craft beer and electrogravitics.