What Is XML-RPC and How to Disable it in WordPress for Security and Performance?

XML-RPC is a core WordPress API which has been around for a number of years. Its primary use is to allow developers to connect to their websites through third-party tools such as mobile applications or specifically designed software.

The problem with XML-RPC is it’s also a common method a hacker can use to exploit a WordPress website, so if you’re not using it yourself, it has been recommended by a number of security experts to close the potential door by disabling it altogether.

Method One : Disable XML-RPC with a PHP Filter

This method requires you to add this line of code to either your child theme’s functions.php file, or to a Code Snippet plugin which allows PHP snippets. This is the easiest method and recommended for beginners.

add_filter( 'xmlrpc_enabled', '__return_false' );

Method Two : Disable XML-RPC in the .htaccess File

This method is slightly more complicated as it requires access to the .htaccess file within the File Manager. Most website owners will have this, but you’ll need to log into your hosting environment to find it. The benefit of this method is you can add an additional line to allow connections from specific IP addresses if you require the use of XML-RPC in the future.

# Block Requests to xmlrpc.php
<Files xmlrpc.php>
 deny from all
</Files>

Testing

To test you’ve disabled XML-RPC correctly, visit yourwebsite.com/xmlrpc.php (replacing yourwebsite.com with your domain name). If XML-RPC has been disabled correctly, you should see a"Forbidden" message. This is the sort of thing my care plans handle each month.