Disable XML‑RPC in WordPress (and what breaks if you do)

Disable XML-RPC in WordPress (and what breaks if you do)

XML-RPC is a remote procedure call protocol used by WordPress to enable communication between your site and external applications. While it offers useful features like remote publishing and mobile app connectivity, it can also be a security risk or a performance bottleneck. This guide explains how to disable XML-RPC in WordPress safely, what functionality you lose by doing so, and how to verify the change.

Quick Fix: How to Disable XML-RPC in WordPress

1. Add the following code snippet to your theme’s functions.php file or a site-specific plugin to completely disable XML-RPC:

add_filter('xmlrpc_enabled', '__return_false');

2. Alternatively, block access to the xmlrpc.php file via your web server configuration (Apache or Nginx).

Why This Happens: Understanding XML-RPC and Its Risks

XML-RPC was introduced in WordPress to allow external applications to interact with your site, such as posting content remotely, managing comments, or using mobile apps. However, it has become a common target for brute force attacks and DDoS amplification because it allows multiple authentication attempts in a single request.

Disabling XML-RPC reduces your attack surface and can improve site performance by preventing unnecessary requests. However, some legitimate services and plugins rely on XML-RPC, so disabling it may break certain features.

Step-by-Step: How to Disable XML-RPC in WordPress

Method 1: Disable XML-RPC via WordPress Filter

1. Access your WordPress site files via FTP, SFTP, or your hosting file manager.
2. Navigate to wp-content/themes/your-active-theme/ and open functions.php.
3. Add the following line at the end of the file:

add_filter('xmlrpc_enabled', '__return_false');

4. Save the file and upload it back if using FTP.
5. Test your site to ensure it functions normally.

Method 2: Block XML-RPC via Apache (.htaccess)

1. Open or create the .htaccess file in your WordPress root directory.
2. Add the following code to block access to xmlrpc.php:

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

3. Save and upload the file.

Method 3: Block XML-RPC via Nginx Configuration

1. Access your Nginx server configuration file for your site (e.g., /etc/nginx/sites-available/your-site.conf).
2. Add this location block inside the server block:

location = /xmlrpc.php {
  deny all;
  access_log off;
  log_not_found off;
}

3. Save the file and reload Nginx:

sudo nginx -s reload

Verification: How to Confirm XML-RPC Is Disabled

1. Use an online XML-RPC tester such as https://xmlrpc.eritreo.it/ to check your site’s XML-RPC endpoint.
2. Send a POST request to https://yourdomain.com/xmlrpc.php. You should receive a 403 Forbidden or a message indicating XML-RPC is disabled.
3. Alternatively, run this command from your terminal:

curl -I https://yourdomain.com/xmlrpc.php

The response headers should indicate access is denied or the file is unreachable.

Works on

Environment	Compatibility
Apache (with .htaccess)	Fully supported
Nginx	Fully supported via config block
LiteSpeed	Supports .htaccess rules and PHP filters
cPanel	Supports all methods, access via file manager or terminal
Plesk	Supports all methods, access via file manager or terminal

FAQ

Q1: Will disabling XML-RPC break the WordPress mobile app?

A1: Yes, the official WordPress mobile app relies on XML-RPC to communicate with your site. Disabling it will prevent the app from working properly.

Q2: Can I disable XML-RPC partially instead of completely?

A2: Yes, you can use plugins or custom code to disable specific XML-RPC methods or limit access to trusted IPs instead of disabling it entirely.

Q3: Does disabling XML-RPC improve site security?

A3: Yes, it reduces the attack surface by blocking a common vector for brute force and DDoS attacks.

Q4: Will Jetpack or other plugins stop working if I disable XML-RPC?

A4: Jetpack and some other plugins depend on XML-RPC. Disabling it may cause them to malfunction or lose features.

Q5: Is there a plugin to disable XML-RPC without editing code?

A5: Yes, plugins like “Disable XML-RPC” or security plugins such as Wordfence provide options to disable or restrict XML-RPC easily.