What is xmlrpc.php, and should you turn it off?
xmlrpc.php is a core file in the WordPress root. It accepts remote calls over HTTP, with the body written in XML. WordPress has left it enabled by default since version 3.5. The REST API now handles the mobile app and most remote publishing, which is what this file used to do.
Turn it off when the site is a brochure, a blog, or a shop and nothing on it uses Jetpack or an old desktop publisher. The file is still installed when no plugin calls it, so it stays on the attack surface. Do not delete it. A WordPress update restores the file, and a missing file is not a block.
- It is a core file, and WordPress has left it on by default since version 3.5.
- The REST API now does the remote publishing this file used to do.
- Do not delete it. An update puts the file back, and a missing file is not a block.
How do attackers use XML-RPC?
Access logs usually show two patterns. A pingback asks your site to fetch some other address. Attackers send that call from many WordPress sites toward one victim, so your server joins a flood. That is the xmlrpc ping traffic people search for.
The other pattern is login guessing. One POST can carry many username and password pairs inside system.multicall, so you see fewer log lines than guesses. Closing the login form does not close this file. Changing the WordPress login URL is a different door.
Which block actually stops the file?
Pick the row that matches the result you can see in a browser. Only a web-server deny stops PHP from running the file.
| Method | What it changes | What the browser shows |
|---|---|---|
| .htaccess or LiteSpeed deny | The web server refuses xmlrpc.php before PHP runs. | 403 Forbidden. |
| xmlrpc_enabled filter, including Disable XML-RPC | Methods that require a password are refused. Pingback can remain. | XML-RPC server accepts POST requests only. |
| xmlrpc_methods cleared | The method list, including pingback, is empty. PHP still runs the file. | The same POST-only line on a normal visit. |
| Deleting xmlrpc.php | The file is gone until WordPress updates. | A missing-file error, then the file returns after an update. |
The Disable XML-RPC plugin, and the filter xmlrpc_enabled set to false, only refuse methods that require a login. Pingback is not in that check. Clearing the method list with xmlrpc_methods removes pingback too. A browser can still load the file and print the POST-only line.
WebJi® cPanel hosting runs LiteSpeed, and LiteSpeed reads .htaccess, so the deny below works there. If the account has no .htaccess file, email support@webji.services and ask for a deny on the URI /xmlrpc.php. That inbox is 24/7 in Hindi and English, with an average first reply under 60 minutes. The office phone is not the support line.
How do you deny xmlrpc.php in .htaccess?
Do this on a copy of .htaccess you can put back. The block belongs at the top of the file, above the WordPress rewrite rules.
- Download a copy of .htaccess before you edit it. In cPanel File Manager, open the folder that contains wp-config.php, usually public_html. Turn on hidden files if you do not see .htaccess.
- At the top of the file, above the WordPress block, add
<Files "xmlrpc.php">, thenRequire all denied, then</Files>. Save. - Open a private window and request /xmlrpc.php on your domain. Stop when you see 403 Forbidden, not the sentence about POST requests.
- If the homepage is a 500 error, remove those lines. Use
Order deny,allowandDeny from allinside the same Files block, save, and repeat the private-window test. - If Jetpack or a remote publisher stops connecting, remove the block. That tool still needs the file.
What does the Disable XML-RPC plugin change?
Open Plugins, then Add New, search for Disable XML-RPC, and activate the plugin by Philip Erb. There is no settings page. To turn it off, use Deactivate on the Plugins screen. If the dashboard will not load, rename that plugin folder under wp-content/plugins.
Activation is not a 403. Use the plugin only when you cannot edit .htaccess and you can accept that the file still runs. For a full stop, use the .htaccess block and leave this plugin off so the two are not confused.
When should you leave XML-RPC on?
Leave xmlrpc.php reachable if Jetpack says it cannot connect, or if a desktop publisher only speaks XML-RPC. The current WordPress mobile app uses the REST API and does not need this file. If you are not sure which tool needs it, add the deny, then check Jetpack and any remote publisher. The one that fails is the one that needed the file.
On WordPress hosting, an unused endpoint is extra noise on a shared IP. WordPress security covers the login, the plugins, and this file if you want that reviewed as one job.
How do you know the block worked?
Open your domain, then /xmlrpc.php, in a private window. Before the change, the page is plain text: XML-RPC server accepts POST requests only. The same sentence after a plugin or a filter means the file is still running.
After the .htaccess deny, that URL should be 403 Forbidden or the host's blocked page. It should not be the POST-only sentence, and it should not be your homepage. Load a normal post and the dashboard as well. A correct block changes only that one address.
Frequently Asked Questions
Should I disable XML-RPC on my WordPress site?
Yes, unless Jetpack or an old remote publisher still connects through it. The current WordPress app uses the REST API. Deny the file in .htaccess so a browser gets 403 Forbidden.
What is xmlrpc.php used for?
It is the old remote interface in the WordPress root. Apps used it to publish and to send pingbacks before the REST API. On a current site that does not use Jetpack or an old publisher, it has no job left.
How do I check if XML-RPC is enabled on my site?
Open your domain plus /xmlrpc.php. The POST-only sentence means the file is still running. A 403 Forbidden means the server is blocking it.
How do I block XML-RPC in .htaccess?
Add three lines at the top of the file: a Files tag for xmlrpc.php, Require all denied, and the closing Files tag. A 403 on /xmlrpc.php means it worked. A 500 on the homepage means you should switch to Deny from all.
Does the xmlrpc_enabled filter fully disable XML-RPC?
No. It stops methods that ask for a username and password. The file still runs, and a browser can still show the POST-only line. Pingbacks sit outside that check.
Does disabling XML-RPC break Jetpack?
It can. If Jetpack loses its connection right after the deny, the block is the cause. Remove the Files block and confirm Jetpack connects. Email support@webji.services if you need the URI closed and Jetpack kept.
Can I delete xmlrpc.php?
No. It is a core file. The next WordPress update restores it, and some plugins expect the file to exist even when the server returns 403. Deny the file. Do not remove it.