XML-RPC is a WordPress feature originally built to enable remote publishing and mobile app connectivity, but it’s become one of the most commonly exploited attack surfaces on the platform. Because it allows external applications to interact directly with WordPress, attackers frequently weaponize it for brute-force login attempts, DDoS amplification, and pingback abuse — making it one of the first things worth locking down on any WordPress site.
What Makes XML-RPC a Security Risk
XML-RPC supports several legitimate functions, including remote publishing from tools like the WordPress mobile app, pingbacks that notify other blogs of links, and integration with plugins and services like Jetpack. The problem is that these same capabilities open the door to abuse when the feature isn’t actively needed.
- Brute force attacks — XML-RPC’s
system.multicall method lets attackers bundle hundreds of login attempts into a single request, effectively bypassing traditional login-attempt limits and rate-limiting plugins designed to stop this kind of abuse
- DDoS amplification — attackers exploit the pingback feature to force a server to send requests to attacker-controlled targets, turning the site into an unwitting participant in distributed denial-of-service attacks against other targets
- Resource drain — even unsuccessful attack attempts can spike server resource usage and slow down site performance for legitimate visitors
Signs your site may be under an XML-RPC attack include a spike in failed login attempts, unusually high resource usage, and noticeably slower site performance.
Disable XML-RPC Completely (Recommended for Most Sites)
For the vast majority of modern WordPress sites, XML-RPC is no longer necessary, since the WordPress REST API now handles most remote connections and mobile app functionality more securely. Disabling it entirely has no negative impact for over 99% of sites.
Via .htaccess:
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
Add this snippet to your site’s .htaccess file to block all external requests to the endpoint directly at the server level.
Via a security plugin:
Plugins like “Disable XML-RPC” or comprehensive security suites like Wordfence and Jetpack allow you to disable the feature entirely or selectively control which XML-RPC functions remain active, without needing to touch server files directly.
If You Still Need XML-RPC Active
Some sites rely on plugins or services, such as Jetpack or certain mobile publishing tools, that genuinely require XML-RPC to function. In those cases, a full shutdown isn’t practical, so the goal shifts to limiting exposure instead.
- Disable pingbacks and trackbacks — go to Settings > Discussion in the WordPress admin panel and uncheck “Allow link notifications from other blogs,” since pingbacks are one of the most commonly abused XML-RPC functions for DDoS attacks
- Rate-limit requests — plugins like “Limit Login Attempts Reloaded” can restrict how many login attempts are permitted through XML-RPC specifically
- Use fail2ban — configure fail2ban to monitor server logs and automatically block IP addresses making repeated access attempts to xmlrpc.php
- Hide the endpoint URL — plugins like “WPS Hide Login” can obscure both the login page and XML-RPC URLs, making them harder for automated scanners to locate in the first place
Strengthen Authentication Regardless
Even with XML-RPC disabled or restricted, strong account security remains essential.
- Use strong, unique passwords for all administrator accounts
- Enable two-factor authentication (2FA) so attackers can’t gain access even with a valid username and password combination
- Regularly review user accounts and remove any that are no longer needed
Deploy a Web Application Firewall
A web application firewall (WAF) adds a broader layer of protection by monitoring and filtering incoming XML-RPC requests for malicious patterns before they reach your site. WordPress-specific solutions like Wordfence or Sucuri include built-in XML-RPC protection, and can detect and block suspicious traffic automatically rather than relying solely on manual configuration.
Keep Everything Updated
Security patches addressing XML-RPC vulnerabilities are frequently rolled into WordPress core updates, so keeping WordPress, themes, and plugins current is a foundational layer of defense. Notably, WordPress blocked certain xmlrpc.php attack vectors by default starting with the 5.4.2 core release, so running an outdated version can leave a site exposed to issues that have already been patched.
A Layered Approach Works Best
No single step fully eliminates risk on its own. Disabling XML-RPC is the most effective single action for sites that don’t need it, but combining that with strong authentication, a web application firewall, and regular core updates creates a more resilient, multi-layered defense that holds up over time rather than depending on one fix.
Join The Discussion
XML-RPC attacks are one of those security issues that quietly affect a huge number of WordPress sites without owners realizing it until performance takes a hit. Have you dealt with an XML-RPC attack on your own site, or found a particular plugin or firewall setup that worked well for you? Share your experiences, questions, or security tips below.
