XML-RPC is a protocol that allows remote communication with WordPress. However, it is one of the most commonly used entry points by attackers to perform brute force and DDoS amplification attacks.
If you don’t use features such as remote publishing from mobile apps or external services, it’s recommended to disable it.
🛠 How to Disable XML-RPC in WordPress
1️⃣ Plugin Method (Easy)
Go to Plugins > Add New > search for and install “Disable XML-RPC-API.”
Once installed and activated, it will start working.
You can check its settings by following these steps (the following options should be set to OFF):
2️⃣ Manual Method with Code (Advanced)
If you prefer to avoid plugins, add this code to the .htaccess file in the directory where WordPress is installed:
Order Allow,Deny Deny from all
From cPanel’s File Manager, edit the “.htaccess” file.
If you can’t locate it, follow this guide to show hidden files:
🔎 How to Check if XML-RPC is Disabled
Use tools like https://iptools.net.au/xmlrpc-tester or try accessing yoursite.com/xmlrpc.php, for example:
https://guiasered.net/xmlrpc.php.
If you see a 403 or 404 error, it is correctly disabled.
If XML-RPC is enabled, you’ll see the following:
If XML-RPC is disabled, you’ll see the following:
✅ Conclusion
Disabling XML-RPC in WordPress is a simple yet effective measure to prevent brute force attacks and improve your site’s security.