WordPress XML-RPC: is it a security risk, and should you turn it off?

A guide for site owners. Updated October 12, 2026.

xmlrpc.php is an old remote-control door in WordPress. Long before the REST API, apps used it to publish posts, upload images and manage comments from outside the site. It is still switched on by default, and it still checks usernames and passwords.

What bots do with it

• Guess passwords. Every XML-RPC method that needs a login, such as wp.getUsersBlogs, is a password check. Bots use it because it never shows a page, so protections that only sit on the login page, like a CAPTCHA or a renamed login address, don't apply.
• Pingback abuse. pingback.ping asks your site to fetch another address. Attackers send it to thousands of sites at once to aim their traffic at a victim, or to probe addresses from your server.

What changed in WordPress 4.4

You'll still read that one XML-RPC request can try hundreds of passwords with system.multicall. That was true until WordPress 4.4 (2015). Since then, after one wrong password in a request, WordPress refuses the rest of that request without checking them. Today the risk is the steady stream of single guesses through a door that login-page protections miss, not one giant request.

Who still needs it

Jetpack uses XML-RPC to talk to WordPress.com, and some older apps and publishing tools still log in through it. Most sites that use neither don't need it at all. If you're not sure, leave it on and limit it first (option 1), then watch your logs for a week.

Is it on? Check in 10 seconds

Open https://yoursite.com/xmlrpc.php in a browser. If it says "XML-RPC server accepts POST requests only.", it's on. Or run the free store check, which also looks for public usernames, a checkout open to card testers and more.

Three ways to deal with it

1. Keep it, but count its failed logins (safest if anything uses it)

A login limiter that counts XML-RPC's wrong passwords together with the login page's locks the guesser out of every door at once. Jetpack and apps keep working. The free Ropeline plugin does this out of the box: 5 wrong passwords in 15 minutes, from any door, locks that address out.

2. Turn off XML-RPC logins only

WordPress has a switch for this. A small plugin or your theme's functions.php can add:

add_filter( 'xmlrpc_enabled', '__return_false' );

That turns off the methods that need a login. It does not turn off pingbacks; to remove those too:

add_filter( 'xmlrpc_methods', function ( $methods ) {
	unset( $methods['pingback.ping'], $methods['pingback.extensions.getPingbacks'] );
	return $methods;
} );

Ropeline Pro has a "Turn off XML-RPC logins" setting that does the first part for you.

3. Block xmlrpc.php at the server (if nothing uses it)

The most thorough option: requests never reach WordPress at all. On Apache (in .htaccess):

<Files xmlrpc.php>
  Require all denied
</Files>

On nginx:

location = /xmlrpc.php { deny all; }

Many hosts and firewalls (Cloudflare's included) can do the same with a rule. This breaks Jetpack and anything else that uses XML-RPC, so check first.