What Is XML-RPC and Why Is It a Security Risk on WordPress?

XML-RPC is a feature built into WordPress that most site owners have never heard of and almost never use. Attackers know it well. It gives them a way to run certain attacks much faster than the normal login page allows.

You can disable it. For most small business sites, you should.

What is XML-RPC?

XML-RPC is a protocol that lets external applications communicate with your WordPress site remotely. When WordPress was young, this mattered: mobile apps used it to publish posts, and desktop blogging tools used it to connect to your site without a browser.

Today, the WordPress app and most modern integrations use a different, more modern system. For the majority of small business sites, XML-RPC is enabled by default and unused.

How do attackers use it?

Attackers exploit XML-RPC in a specific way. The standard WordPress login page allows one login attempt per request. Most security plugins detect repeated failed attempts from the same IP and block them.

XML-RPC can process multiple commands in a single request. This means an attacker can test hundreds of password combinations in one request, bypassing the protections that watch the login page. The technical term for this type of attack is credential stuffing via multicall.

The result is that brute force attacks through XML-RPC can run much faster than the same attack through the login page, and they often evade the rate-limiting tools designed to stop brute force.

XML-RPC has also been used in distributed denial-of-service attacks, where a large number of requests flood your site and make it unavailable. Attackers send specially crafted requests to your XML-RPC endpoint that trigger your server to make many outbound requests, amplifying their attack.

Do you actually use XML-RPC?

Log into your WordPress dashboard and think about how you manage your site. Do you post content from a mobile app? Does any external service connect to your site using credentials, rather than an API key?

If the answer to both is no, you are not using XML-RPC. It is running on your site as an open endpoint providing attack surface with no benefit.

Most small business owners who have not specifically set up mobile publishing or third-party integrations are in this category.

How to check if XML-RPC is active

You can test whether XML-RPC is enabled on your site by visiting yourdomain.com/xmlrpc.php in a browser. If you see a page that says “XML-RPC server accepts POST requests only,” XML-RPC is active.

How to disable it

A security plugin like Wordfence includes a toggle to disable XML-RPC. That is the simplest approach for most users.

Alternatively, a small rule added to your .htaccess file blocks access to the XML-RPC endpoint at the server level. Your hosting provider may also have a way to disable it through their control panel.

After disabling, confirm the test above returns a 403 error or a blank page rather than the XML-RPC server response.

What you can do today

1. Test whether XML-RPC is active on your site using the URL test described above.
2. If it is active and you do not use it, disable it using your security plugin or .htaccess.
3. Enable login attempt limits on your main login page if you have not already.
4. Review whether any legitimate service you use actually requires XML-RPC before disabling it.
5. After disabling, confirm the endpoint is no longer accessible.

Why this keeps happening

XML-RPC is one door among many. Disabling it removes a specific, well-known attack vector. It does not address the broader plugin attack surface that accounts for 91 percent of new WordPress vulnerabilities.

In 2025, researchers logged 11,334 new WordPress security holes. XML-RPC attacks are a separate and older threat on top of that current vulnerability landscape. Closing XML-RPC is worth doing and takes ten minutes. It is one layer of a larger picture.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free. On a platform with no WordPress installation, XML-RPC does not exist, and neither does the rest of the attack surface that comes with maintaining one.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.