XML-RPC in WordPress, is it worth disabling?
XML-RPC is an interface through which external programs can "talk" to WordPress, publish posts, add comments, collect statistics. It dates from the days when people blogged from a separate application on their computer. Today most sites do not need it at all, and for bots it is a handy back door.
Why attackers like it
The xmlrpc.php file allows two unpleasant things. First, bulk password guessing: a single request can check dozens of login-password combinations, which speeds up a dictionary attack. Second, pingback DDoS: other people's sites with XML-RPC enabled can be used to flood a victim with traffic.
When XML-RPC is still needed
Before you disable it, check whether you use something that relies on it:
- the WordPress mobile app,
- the Jetpack plugin (some features),
- some integrations and external publishing tools.
If you publish and manage the site solely through a browser, there is a very high chance you can safely disable XML-RPC.
The rule is simple: if you do not use something and it can be used for an attack, disable it. Fewer enabled features means a smaller attack surface.
How to disable it safely
The cleanest approach is a WordPress filter (xmlrpc_enabled set to false) or blocking access to the xmlrpc.php file itself at the server level. Both methods are reversible, if needed you restore the previous state. It is important to make a backup before the change and check the site afterwards.
You do not have to do it yourself
Disabling XML-RPC is one of a dozen small steps that together genuinely raise a site's security, alongside blocking file editing, hiding the WordPress version or limiting login attempts. As part of ongoing care we do this for you, deliberately and with a backup.
Want someone to review your site's settings and close such doors? Get in touch, we will check what is worth changing.