How to Disable XML-RPC in WordPress (and Why)

XML-RPC is a common attack vector. Learn what it does and three safe ways to disable it in WordPress.

`xmlrpc.php` is a legacy WordPress endpoint that enables remote publishing and pingbacks. Attackers abuse it for brute-force and DDoS amplification.

Why disable it

If you don't use the WordPress mobile app or Jetpack features that require it, XML-RPC is pure risk.

Option 1 — Block via .htaccess (Apache)

<Files xmlrpc.php>

Order Deny,Allow

Deny from all

</Files>

Option 2 — Block via Nginx

location = /xmlrpc.php { deny all; }

Option 3 — A security plugin

Wordfence, iThemes Security and others can disable XML-RPC with one toggle.