Beginner's Guide for WordPress / Start your WordPress Blog in minutes

How to Disable XML-RPC in WordPress (Secure Method)

Do you want to disable XML-RPC on your WordPress site?

XML-RPC is a core WordPress API that allows users to connect to their WordPress website using third-party apps, tools, and services. Unfortunately, in the past hackers have found ways to exploit XML-RPC to gain access to WordPress websites.

In this article, we’ll show you how to easily disable XML-RPC in WordPress.

Easily disable XML-RPC in WordPress

What Is XML-RPC in WordPress?

XML-RPC is a core WordPress API that has been enabled by default since WordPress 3.5 was released in 2012. It allows developers to use XML and HTTPS protocols to connect to and interact with your WordPress website.

In short, you need XML-RPC enabled to access and publish your blog remotely, such as when you want to use a mobile app to manage your site or make connections to automation services such as Uncanny Automator or Zapier.

However, if you’re not using mobile apps with your website, then some WordPress security experts may advise you to disable XML-RPC. This closes a door that may potentially be exploited to hack your website.

That being said, let’s take a look at how to easily disable the XML-RPC API in WordPress. The .htaccess method is best because it’s the least resource intensive, and the other methods are easier for beginners.

Method 1: Disable WordPress XML-RPC With .htaccess (Advanced)

This method is for advanced users because it requires you to edit your site’s .htaccess file. We recommend that beginners use Method 2 or 3.

This way has several advantages, such as the ability to give remote access to yourself and your team while restricting everyone else. It also won’t negatively affect your WordPress performance, since it disables XML-RPC requests before they are passed on to WordPress.

You will need to add the following code to your .htaccess file. You can do this by connecting to your site using an FTP client or file manager. Also, All in One SEO users can use the plugin’s built-in editor tool to add the code snippet, as you can see in the screenshot below.

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
 deny from all
allow from 123.123.123.123
</Files>
Use AIOSEO Pro to disable XML-RPC from htaccess

If you wish to give a certain user remote access to your site, then simply replace ‘123.123.123.123’ on line 5 with their IP address. You can add multiple IP addresses by separating them with spaces.

Or, if you want to disable XML-RPC completely, then delete line 5 altogether.

Note: If you can’t locate .htaccess, then see our guide on why you can’t find .htaccess in WordPress.

Method 2: Disable WordPress XML-RPC With a Code Snippet (Recommended)

This method requires you to add some code to your WordPress website. If you haven’t done this before then take a look at our guide on how to copy and paste custom code snippets in WordPress.

WPCode is the easiest and safest way to add code to your WordPress site. It helps you to manage your code snippets and prevents any errors from breaking your site.

In this method, we will use one of WPCode’s built-in code snippets to disable XML-RPC.

First, you need to install the free WPCode plugin. For step-by-step instructions, check out our step-by-step guide on how to install a WordPress plugin.

Upon activation, head over to Code Snippets » Add Snippet. The WPCode library already contains a snippet that disables XML-RPC. You can find it by searching for ‘xml.’

Once you find it, you need to click the ‘Use snippet’ button.

Use WPCode Library to disable XML-RPC

Next, you need to switch the ‘Active’ toggle to the ‘On’ position.

Finally, make sure you click the ‘Update’ button to enable the snippet on your site and disable XML-RPC API.

Turn the WPCode snippet on by clicking Activate and pressing Update

Method 3: Disable WordPress XML-RPC With a Plugin

This is a simple method that can be used if you don’t want to add any other customizations to your website with a code snippet plugin

Simply install and activate the Disable XML-RPC-API plugin. For more details, see our step-by-step guide on how to install a WordPress plugin.

The plugin works out of the box and will immediately deactivate XML-RPC.

You can navigate to XML-RPC Security » XML-RPC Settings to configure the plugin. For example, you can allow certain users to access XML-RPC by whitelisting their IP addresses.

The Disable XML-RPC-API Plugin Settings

Testing That WordPress XML-RPC Is Disabled

Now you should check to make sure you successfully disabled the XML-RPC API on your WordPress website.

You can also check that XML-RPC is disabled by simply visiting the URL http://example.com/xmlrpc.php in your browser. Make sure you replace ‘example.com’ with your own website’s domain name.

If XML-RPC is disabled, you should see the error message: ‘Forbidden: You don’t have permission to access this resource.’

We hope this article helped you learn how to easily disable XML-RPC in WordPress. You may also want to learn how to install Google analytics in WordPress, or check out our list of live chat software for small business.

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.

Disclosure: Our content is reader-supported. This means if you click on some of our links, then we may earn a commission. See how WPBeginner is funded, why it matters, and how you can support us. Here's our editorial process.

The Ultimate WordPress Toolkit

Get FREE access to our toolkit - a collection of WordPress related products and resources that every professional should have!

Reader Interactions

46 CommentsLeave a Reply

  1. Hey WPBeginner readers,
    Did you know you can win exciting prizes by commenting on WPBeginner?
    Every month, our top blog commenters will win HUGE rewards, including premium WordPress plugin licenses and cash prizes.
    You can get more details about the contest from here.
    Start sharing your thoughts below to stand a chance to win!

  2. in htaccess, the line:
    allow from 123.123.123.123
    Looks like it wants to be edited with my IP address. But this is not stated anywhere —?

    • Blocking would attempt to limit access to the feature while disabling would turn it off completely. If you disable it you wouldn’t need to worry about someone accessing it through a different method.

      Admin

  3. The recomnended plugin Disable XML-RPC has not been updated since last 2 years. It says the plugin has not been tested with the last 3 releases of wordpress.

  4. Hi,

    Will disabling the xmlrpc.php access also disable the access to wordpress apis used for android/ios app development?

  5. Found the solution:
    Adding following information in nginx config:
    # nginx block xmlrpc.php requests
    location /xmlrpc.php {
    deny all;
    }

  6. I use nginx instead of Apache. Can I still use .htaccess on my site?
    And do I need to store this file in public_html directory, or one level above it?

    • Yes, the .htaccess in your site’s root folder is where you would add the .htaccess code :)

      Admin

  7. why would we allow 123.123.123.123 ?

    If we aren’t using the service at all, why not let “deny all” be absolute?

    • If i’m reading the code correctly;
      order deny,allow – puts deny before allow, since deny is ‘all’ then allow isn’t processed
      deny from all – does what it says
      allow from 123.123.123.123 – is a place holder

      I gather that if you have a fixed IP address you could change order to “allow,deny” and replace 123.123.123.123 with your IP address. That would allow your IP then deny all others.

  8. Thanks WP-Beginner, I’m trying to be baddest WP boy in my neighbourhood and this is exactly why I keep coming back to you guys, each question I have you say; here is the easy way, and here is the RIGHT way :-)

    Me an my .htaccess are going to have a little chat about htpasswrd and this here XMLRPC thingy my clients will never need.

    You all just made my corner of the net a little bit safer, as MailChimp would say: High Fives!

  9. Ok, i will use this code but i want IFTTT to have work on my website what i need to add?

    # Block WordPress xmlrpc.php requests

    order deny,allow
    deny from all
    allow from 123.123.123.123

  10. Hi,

    I have followed the instructions to block the xmlrpc.php file using .htaccess but im not sure if it is working.

    Im using wordfence security and in the live traffic view i can see the requests for the xmlrpc.php file have stopped, but if i check my access logs

    tail -f /apache2/logs/access_log

    I can still see the requests coming in, but the code at the end has changed from 500 to 403. Im concerned im getting a false report from my WordFence plugin and that im still being flooded with spam. Can anyone advise?

    Thanks,

    PhilB

    • Oh yeah! Thats working perfectly, your XMLRPC is FORBIDDEN!

      HTTP Status Code 403: The server understood the request but refuses to authorize it.

  11. I got a weird problem…

    I’m using my wordpress blogs with IFTTT and all worked fine, until I integrated it with MaxCDN; IFTTT immediately stopped working. I did some research and the problem might be related to XML-RPC that was de-activated.

    When I check my dashbord in “Settings” > “Writing” , I don’t see anything like XML-RPC, Remote Publishing, etc. I’ve checked database in options, also xml-rpc not available / missing.

    I need to activate XML-RPC to keep my IFTTT working.

    How do I re-activate XML-RPC; all I need is a script that I can add in .htaccess or functions.php to activate XML-RPC.

    And why am I missing the XML-RPC funtionality in my dashboard.

    Thank You!

  12. I was searching for how to add this file xmlprc.php to my wordpress i am using 4.5.3 version and i came to this page. I need to add this php file because when i enable jetpack i got error of site_inaccessible. Please tell me hot to resolve this error my site is

    • Connect to your WordPress site using FTP client or File Manager in cPanel. In your website’s root directory look for xmlrpc.php file. If it is there, then try step 2. If it isn’t then download a fresh copy of WordPress. Unzip and extract it and upload xmlrpc.php file back to your site’s root directory.

      Step 2: Check your WordPress theme’s functions file for the code that disables XML-RPC.

      Step 3: Check your .htaccess and wp-config files.

      Admin

  13. Please,what can i do to enable xmlrpc on my site?because i can’t login using wordpess mobile app on my smartphone..

  14. Booyah! This WP filter fixed the script kiddie attack. I still firewalled the person, but I don’t have to watch the logs like a hawk to add more IPs to the firewall. THANK YOU.

  15. I’m totally onboard for disabling xmlrpc.php server wide in my /etc/httpd/conf/includes/pre_main_global.conf file. But I am left with this questions…is there a way to determine that a particular plugin “NEEDS” xmlrpc.php in order to work? I have concerns with blocking access to it and then having an issue 2 months down the road and not know that the issue is with the fact that I blocked xmlrpc.php previously.

    Are there any common signs to look for in a log file or such which would point to a xmlrpc.php block as the cause?

  16. Hey am using WordPress app to post with my android smartphone. Now I can’t login and my login credentials are correct. The response I got was ” we can’t log you in couldn’t connect to the WordPress site”.Could you help me fix this WordPress app login error.

    • If you had disabled XML RPC then you may not be able to login using WordPress mobile app. Look in your theme’s functions.php file for this code

      add_filter('xmlrpc_enabled', '__return_false');

      If it is there, then you need to remove it. You can also try deactivating plugins and turning them on one by one until you find the plugin that is stopping you from login using WordPress mobile app.

      Admin

  17. It’s worth noting, that “allow from 123.123.123.123” is optional, and if used should be updated to include your IP, or the IP of the device that needs access to xmlrpc.php (it would be good to cite examples in this article).

  18. I am using GoodbyeCaptcha plugin to turn off the XML-RPC and works with no problem while Jetpack is activated.
    Hope it helps

  19. Sorry, I’ve tried this method many times. It didn’t work for me – in fact it brought the front end down (blocking visitors read access to the web page) after adding these codes to the .htaccess file.

  20. Keith, there’s a trend in WordPress to move non-theme related functions out of the functions.php file and into a “site specific plugin”, basically a plugin that you only activate on one unique website and it stores the non-theme related functions for that site.

    You can accomplish the same thing by placing the code in your functions.php file.

  21. Hi Guys
    Sorry to be a bit thick but could you expand on… “All you have to do is paste the following code in a site-specific plugin:”

    Which plugins are site specific?

Leave A Reply

Thanks for choosing to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and your email address will NOT be published. Please Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.