XML-RPC Is a Legacy WordPress Feature That Enables Most Brute Force Attacks. Disable It in One Minute.
WordPress XML-RPC allows remote connections to your site — used historically by the WordPress mobile app and some third-party tools. Today, its primary users are hackers running brute force attacks that try thousands of passwords through the XML-RPC endpoint. If you do not use the WordPress mobile app or remote publishing tools, disabling XML-RPC closes a major security vulnerability.
“XML-RPC is the most attacked WordPress feature that most sites do not need. Disabling it is like locking a door you never use — simple, permanent, and effective.”
Disabling XML-RPC
Plugin method: Install “Disable XML-RPC.” One click. Done. Theme functions.php: Add add_filter('xmlrpc_enabled', '__return_false');. .htaccess method: Add rules to block access to xmlrpc.php entirely. Cloudflare WAF: Create a firewall rule to block requests to xmlrpc.php before they reach your server. Before disabling: Confirm you do not use the WordPress mobile app (it uses XML-RPC to publish and edit). Confirm you do not use Jetpack (it uses XML-RPC for some features — Jetpack can work without it, but check documentation). Confirm you do not use any third-party tools that connect to your site via XML-RPC — pingbacks, trackbacks, some mobile apps, some automation tools. For professional security hardening, see our WordPress Services page.
“Disabling XML-RPC reduces brute force attack attempts on your site by 80% or more. One minute of work. Permanent security improvement.”
