What is XML-RPC?
XML-RPC is a remote access interface built into WordPress, exposed through a file called xmlrpc.php, and it is one of the most common findings in a WordPress security scan. It was designed years ago to let external applications publish to and manage a WordPress site remotely. While it still has a few legitimate uses, it has become better known as an attack surface, because the same features that make it useful also make it attractive to attackers. Understanding what XML-RPC is helps you decide whether to keep it, protect it, or switch it off.
What is XML-RPC and what was it for?
XML-RPC is a way for other software to call functions on your site over the web, sending requests in a structured XML format. In WordPress it powered remote publishing long before the modern REST API existed: desktop blogging clients, mobile apps and cross-site features like pingbacks all relied on it. On most current sites, though, these functions are either unused or handled by newer interfaces, which means xmlrpc.php often sits enabled and exposed while serving no real purpose.
Why XML-RPC gets flagged in security scans
Two features of XML-RPC make it genuinely risky when left open:
- Brute-force amplification. A method called system.multicall lets an attacker bundle hundreds of login attempts into a single request, so they can test huge numbers of passwords quickly while making far fewer, quieter connections than a normal brute-force attack.
- Pingback abuse. The pingback feature can be tricked into making your server send requests to other machines. Attackers use this to launch distributed denial-of-service attacks through many innocent sites at once, and to probe internal systems the server can reach.
Because these abuses need no vulnerability in your specific plugins, any site with xmlrpc.php open is a potential target, which is why scanners highlight it.
Should you disable XML-RPC?
For the majority of modern sites, yes. If nothing you use depends on it, disabling XML-RPC removes an entire attack surface at no cost. The main exceptions are some older integrations and a few services that still rely on it, so the safe approach is to confirm nothing important uses it before switching it off. If you rely on a service that needs XML-RPC, the alternative is to protect rather than remove it, for example by disabling only the pingback methods and putting strong brute-force protection in front of the login process.
How to disable or protect XML-RPC
- Block it at the server by denying access to xmlrpc.php in your web server configuration, which stops the requests before WordPress even loads.
- Disable it in WordPress using a filter that turns the interface off, or a reputable security plugin that offers a single toggle.
- Disable pingbacks specifically if you need to keep other XML-RPC features, which removes the denial-of-service and probing risk.
- Add login protection such as rate limiting and two-factor authentication to blunt the brute-force amplification.
Whichever route you choose, verify afterwards that the file no longer responds to unauthenticated requests. These flaws often travel alongside other issues in outdated components, which is why keeping everything current, as covered in our guide on WordPress plugin and theme vulnerabilities, matters too. If you suspect XML-RPC has already been used to attack you, our guide on how to tell if your website has been hacked explains what to look for.
How to check XML-RPC on your site
You may not know whether xmlrpc.php is open, or whether it is quietly absorbing brute-force traffic right now. Run a security scan with EzyAudit AI and we check whether XML-RPC is exposed, explain the specific risk to your site, and tell you how to close it, alongside the rest of your security posture. See the full list of checks we run. For official guidance, the WordPress developer documentation on XML-RPC describes the interface and its methods.
XML-RPC is a legacy feature that many sites can safely switch off to shrink their attack surface. Scan your website now to see whether XML-RPC is exposed on your site.