How to disable WordPress XML-RPC

What this problem looks like

XML-RPC lets remote clients call WordPress methods over HTTP POST. Most modern sites do not need it. Attackers use it for password guessing and pingback floods.

Blocking at Apache or nginx is more efficient than PHP plugins because requests never reach WordPress. Test Jetpack and mobile apps after blocking.

Step 1: Decide if you need XML-RPC

Jetpack, some mobile apps, and legacy remote clients use xmlrpc.php. If you use none of these, disable it. WooCommerce REST API does not require XML-RPC.

• Jetpack: may require XML-RPC unless using modern connection methods.
• WordPress mobile app: historically used XML-RPC.
• Standard REST API: uses /wp-json/ instead.

Step 2: Block xmlrpc.php in .htaccess

Add to .htaccess in the site root on Apache:

<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

Step 3: Disable via filter in a small plugin or functions.php

If you cannot edit server config, add this to a custom plugin or child theme:

add_filter( 'xmlrpc_enabled', '__return_false' );

Step 4: Remove pingback methods only

If you must keep XML-RPC for one service but want to stop pingback abuse, disable pingback methods with a filter rather than blocking the entire file.

Step 5: Verify the block

POST to https://example.com/xmlrpc.php should return 403 or 404. Use an online XML-RPC checker or curl. Confirm Jetpack still connects if you rely on it.

curl -I https://example.com/xmlrpc.php

When to stop DIY and hire help

If brute-force traffic continues after disabling XML-RPC, attackers may target wp-login.php directly. BugShield hardens WordPress login surfaces at a confirmed fixed price.