Disable XML-RPC

XML-RPC was useful in WordPress’s early days — it let you publish posts from desktop apps and mobile devices. But today? The REST API handles all that better. Meanwhile, XML-RPC has become one of the most exploited attack vectors on WordPress sites. Attackers use it for brute force attacks, DDoS amplification, and pingback spam. If you’re not actively using it, turn it off.

Use Cases#

• Block brute force attacks that try thousands of passwords via xmlrpc.php
• Prevent your site from being used in DDoS amplification attacks
• Stop pingback spam from flooding your comments
• Reduce server load from bot requests hitting XML-RPC
• Clean up your site’s attack surface by removing unused functionality

How It Works#

This is a toggle module — enable it and XML-RPC is disabled. No configuration needed.

When enabled, the module:

1. Returns 403 Forbidden for any request to xmlrpc.php
2. Disables all XML-RPC methods at the WordPress level
3. Removes the RSD (Really Simple Discovery) link from your HTML head
4. Removes the Windows Live Writer manifest link
5. Removes the X-Pingback header from responses
6. Disables pingbacks entirely

What Gets Blocked#

Why XML-RPC is a Security Risk#

Brute Force Amplification#

Normal brute force attacks try one password per request. XML-RPC’s system.multicall method lets attackers try hundreds of passwords in a single request. This bypasses many rate-limiting protections.

DDoS Amplification#

Attackers can abuse the pingback feature to make your server send requests to target sites. Your server becomes an unwitting participant in DDoS attacks, and the target sees requests coming from your IP.

Pingback Spam#

Spammers use XML-RPC pingbacks to flood sites with junk trackbacks, often linking to malicious or SEO-spam sites.

Verification#

After enabling, verify XML-RPC is blocked:

1. Visit yoursite.com/xmlrpc.php directly
2. You should see “XML-RPC services are disabled on this site.”
3. View your homepage source — no RSD or wlwmanifest links should appear

Using curl:

curl -I yoursite.com/xmlrpc.php

Should return HTTP/1.1 403 Forbidden

FAQ#