{"id":18965,"date":"2026-10-22T17:00:04","date_gmt":"2026-10-22T14:00:04","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/wordpress-xmlrpc-php\/"},"modified":"2026-10-22T17:00:16","modified_gmt":"2026-10-22T14:00:16","password":"","slug":"wordpress-xmlrpc-php","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/wordpress-xmlrpc-php\/","title":{"rendered":"WordPress xmlrpc.php: What It Is, Why Attackers Target It and When to Disable It"},"content":{"rendered":"
\n
In short<\/b>xmlrpc.php in WordPress is an old interface that lets outside software talk to your site, such as the mobile app and the Jetpack plugin. Attackers exploit it because it allows hundreds of password guesses in a single request, and for pingback attacks. If you do not use a tool that needs it, disable it.<\/div>\n
\"WordPress<\/figure>\n

What does the file do?<\/h2>\n

Before the modern WordPress REST API existed, xmlrpc.php was the only way to publish from an outside app or send pingbacks between blogs. It is still in every WordPress site for compatibility with older tools.<\/p>\n

Why do attackers target it?<\/h2>\n
\n
1<\/i>Multiplied guessing<\/b>The system.multicall method allows hundreds of password guesses in one request, bypassing normal login limits.<\/span><\/div>\n
2<\/i>Pingback attacks<\/b>Your site is used to send requests to another site as part of a DDoS<\/a>.<\/span><\/div>\n
3<\/i>Resource drain<\/b>Thousands of requests to the file slow your site even if they all fail.<\/span><\/div>\n<\/div>\n

Do you need it?<\/h2>\n
\n\n\n\n\n\n\n\n\n
You use<\/th>\nDo you need xmlrpc.php?<\/th>\n<\/tr>\n<\/thead>\n
The WordPress mobile app (older versions)<\/td>\nMaybe<\/td>\n<\/tr>\n
The Jetpack plugin<\/td>\nYes, it relies on it<\/td>\n<\/tr>\n
Publishing from older outside tools<\/td>\nUsually yes<\/td>\n<\/tr>\n
Only the normal WordPress dashboard<\/td>\nNo<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

How to disable it<\/h2>\n
    \n
  1. With your security plugin:<\/b> Most WordPress security plugins<\/a> have a \u201cDisable XML-RPC\u201d option. This is the easiest way.<\/li>\n
  2. Or with .htaccess:<\/b> Add the rule below to your main .htaccess file from the cPanel File Manager, after backing it up.<\/li>\n
  3. Check the result:<\/b> Open yoursite.com\/xmlrpc.php<\/span>. If you see a 403 denied message, it is disabled.<\/li>\n<\/ol>\n
    <Files xmlrpc.php>\n  Require all denied\n<\/Files><\/pre>\n
    If you use Jetpack:<\/b> do not block the whole file. Just disable pingbacks and limit login attempts in your security plugin.<\/div>\n
    \n
    How Hyyat Host protects your site<\/h2>\n