WordPress XML-RPC endpoint is active

What it is

/xmlrpc.php is an old WordPress endpoint for remote publishing (Windows Live Writer, Jetpack, the mobile WP apps). In 2026, 99 % of sites no longer use it — WordPress now communicates over the REST API. But the endpoint is still enabled by default, so unless you actively disable it, it’s publicly accessible.

Why it’s a problem

XML-RPC carries two specific risks:

• Brute-force amplification. The system.multicall method can test dozens to hundreds of username+password combinations in a single HTTP request. This lets an attacker bypass fail2ban and rate-limiting, because from the server’s point of view it sees one request, not 200.
• DDoS pingback amplification. The pingback.ping method forces your WordPress to send an HTTP request to an arbitrary URL — an attacker can use you to attempt a DDoS against a third party.

How to fix it

Option 1 — disable with a filter (quick)

In functions.php or in a site-specific plugin:

add_filter('xmlrpc_enabled', '__return_false');

This disables XML-RPC authentication. The endpoint still responds, but brute-force and pingback attacks will fail.

Option 2 — block at the web server level (better)

nginx:

location = /xmlrpc.php {
    deny all;
    return 403;
}

Apache (.htaccess):

<Files xmlrpc.php>
    Require all denied
</Files>

This way WordPress never receives the request — less load, no PHP execution, better scalability.

Option 3 — plugin

If you’re not comfortable editing configs, the Disable XML-RPC plugin turns it off with a single click.

Verification

curl -I https://example.com/xmlrpc.php
# should return 403 (option 2) or 405 Method Not Allowed (option 1)

What can go wrong

If you use the mobile WP app or Jetpack in “classic” mode, you’ll lose remote publishing. Jetpack has had a REST API fallback since 2018, so in most cases no one will notice.

References

• WordPress REST API (the modern alternative)