Engine Templates

Do you want to disable XML-RPC to protect your WordPress site from unwanted security vulnerabilities? Our blog is a perfect place for you. It contains different methods to help you effectively handle this issue. Now, let’s give it a look.

What is XML-RPC in WordPress and Why should disable it?

XML-RPC is specially designed as a useful communication means between WordPress and other external applications. In the past, XLM-RPC played an important role in helping users to interact with their WordPress website via various blogging platforms or phone apps. You can use it once you want to edit content offline and then connect to your WordPress blog later to publish it.

However, with the significant development of technology, REST API was introduced and integrated into the core of WordPress, so XML-RPC functionality is no longer used to communicate with other systems.

Currently, it seems like REST API is replacing XML_RPC, so you should disable XML-RPC on the WordPress site. In addition, disabling XML-RPC in WordPress also helps you keep your website secure by avoiding your website approaching security vulnerabilities brute force attacks, SQL Injection, Malware, Cross-site Scripting, DDoS attacks, and much more.

But beginning WordPress 3.5 the XML-RPC functionality is enabled by default and there is no option to disable this functionality in WordPress. Therefore, in today’s blog, we will provide you with some easy methods to handle this problem.

How to Disable XML-RPC in WordPress

There are many handy methods to disable XML-RPC WordPress. Nevertheless, we will demonstrate the 3 simplest methods to help you easily execute. Now, let’s check them out.

Method 1: Disable XML-RPC in WordPress by using a plugin

This is the easiest method to disable XML-RPC in WordPress. Since it takes you a few clicks to install the plugin and then the plugin will help you do the rest for you. The plugin that we would like to recommend is Disable XML-RPC. Now, to use this plugin, you need to track the following steps.

First of all, you need to install and activate the plugin by going to Plugins > Add New from your WordPress dashboard. Next, let’s use the search bar functionality to find the plugin.

After finding the plugin from the result list, simply click on the Install Now button and Activate it.

Once the plugin is activated, the plugin will automatically disable XML-RPC functionality in WordPress without configuring any settings.

Method 2: Manually disable XML-RPC by using a filter

This method will be more complicated than using the plugin. Because you need to add some code to your WordPress site.

All you need to do is copy the following code and paste it to a site-specific plugin or use a custom code snippets plugin to add code without breaking your website.

add_filter('xmlrpc_enabled', '__return_false');

Don’t forget to save your changes and now the XML-RPC functionality should be disabled on your WordPress site.

Method 3: Disable XML-RPC in WordPress by editing the .htaccess file

In order to edit the .htaccess file, you need to access your WordPress site by using FTP or File manager. Then, navigate to your WordPress's root directory and open the .htaccess file.

Now, let’s add the following code to the .htaccess file if you want to deny access to the XML-RPC file for everyone.

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

If you want to give access to xmlrpc.php for a specific IP address, then you should use the following code.

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx
</Files>

Remember to replace “xxx.xxx.xxx.xxx” with the IP address that you want to allow.

Summary

To sum up, disabling XML-RPC is a great idea to protect your website from different threats such as hack attacks, and brute force attacks. Hopefully, our blog helped you properly disable XML-PRC in WordPress. If you get into trouble, don’t forget to leave a comment below.

Moreover, we specialize in providing a collection of stunning, responsive, free WordPress Themes, so don’t miss our website.

ET Digital Team

We’re a Digital Team from EngineTemplate with 5 content experts. Our team has 5 years exp in open source Joomla and WordPress, we make daily blogs and build useful resources for everyone who is having issues with open source while using it.