WordPress XML-RPC: When To Disable It Entirely

WordPress's XML-RPC interface has been an attack vector for years. The interface enables features like the WordPress mobile app, certain integrations, and pingbacks. It also enables: brute force authentication attacks, amplification attacks, and various exploits.

The decision to disable XML-RPC entirely depends on whether anything on your site uses it. For most sites in 2026, the answer is no.

What XML-RPC enables

The WordPress mobile app (iOS and Android). Users can edit and publish from the app via XML-RPC.

Pingbacks and trackbacks. Other sites notify yours when they link to your posts.

Some third-party integrations. Specific services that use the XML-RPC API for content management.

Jetpack and some other plugins use XML-RPC for certain features.

What XML-RPC enables for attackers

Brute force authentication. The XML-RPC system.multicall method lets attackers try many credentials in a single request. Faster brute forcing.

Pingback amplification. Attackers send pingback requests that cause your site to make HTTP requests to a target. The target gets traffic amplified through many WordPress sites.

Vulnerability exploitation. Various plugins that expose vulnerable functionality through XML-RPC.

The disable decision

If you don't use the WordPress mobile app, don't have integrations that depend on XML-RPC, and have disabled pingbacks (or don't care about them), disable XML-RPC entirely.

The disable removes the attack surface. The functional cost is minimal for sites that don't use what it provides.

How to disable XML-RPC

Add to functions.php or a site-specific plugin:

add_filter('xmlrpc_enabled', '__return_false');

The filter disables XML-RPC at the WordPress level.

For more thorough disabling, also block the /xmlrpc.php URL at the server level. .htaccess for Apache:

<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

The combination prevents both WordPress-level and server-level access to XML-RPC.

The selective disable

If you use some XML-RPC features but not others, disable specific methods:

add_filter('xmlrpc_methods', function($methods) {
    unset($methods['pingback.ping']);
    unset($methods['system.multicall']);
    return $methods;
});

The selective disable removes the most dangerous methods while keeping the interface available for legitimate use.

The verification

After disabling, verify it works:

Visit yoursite.com/xmlrpc.php. The response should be 403 Forbidden or similar.

If using the WordPress mobile app, verify whether it still works (it shouldn't with full disable).

Check the plugin functionality. Plugins that depend on XML-RPC may stop working.

The plugin alternatives

The Disable XML-RPC plugin handles this without code editing. The plugin's setting toggles XML-RPC on or off.

For non-technical operators, the plugin is easier than editing functions.php.

The REST API consideration

WordPress's REST API has largely replaced XML-RPC for modern integrations. Most contemporary plugins and integrations use the REST API rather than XML-RPC.

Disabling XML-RPC doesn't disable the REST API. The REST API has its own security considerations but is generally more modern and better-secured.

The honest framing

XML-RPC was useful when introduced; in 2026 it's mostly a legacy interface with continuing attack risk. Disabling it for sites that don't use it removes risk without functional cost.

For sites with specific XML-RPC dependencies, evaluate whether the dependencies can be removed (use REST API alternatives where possible). For sites without dependencies, disable immediately.