disable xmlrpc.php in WordPress

WordPress has always had inbuilt features that let you remotely interact with your site. Face it, sometimes you’ll need to access your website and your computer won’t be anywhere nearby. For a long time, the solution was a file named xmlrpc.php. But in recent years, the file has become more of a pest than a solution.

Below we dive into what xmlrpc.php actually is and why it was created. We also overview the common security issues it causes and how to patch them on your own WordPress site.

Method 1: Disabling Xmlrpc.php With Plugins

Disabling XML-RPC on your WordPress site couldn’t be easier.

Simply navigate to the Plugins › Add New section from within your WordPress dashboard. Search for Disable XML-RPC and install the plugin that looks like the image below:

Method 2: Disabling Xmlrpc.php Manually

If you don’t want to utilize a plugin and prefer to do it manually, then follow this approach. It will stop all incoming xmlrpc.php requests before it gets passed onto WordPress.

Open up your .htaccess file. You may have to turn on the ‘show hidden files’ within file manager or your FTP client to locate this file.

Inside your .htaccess file, paste the following code:

  1. # Block WordPress xmlrpc.php requests
  2. <Files xmlrpc.php>
  3. order deny,allow
  4. deny from all
  5. allow from xxx.xxx.xxx.xxx
  6. </Files>

Note: Change xxx.xxx.xxx.xxx to IP address you wish to allow access xmlrpc.php or remove this line completely.

Leave a Comment

Your email address will not be published. Required fields are marked *

Open chat