Disabling XML-RPC in WordPress
Close the xmlrpc.php backdoor before someone brute forces it.
- Answers
- Should you disable xmlrpc.php in WordPress?
- Topics
- cloud · cyber-security · hacking · howto · networking · server · web · webdesign
- Full article on willem.com
- https://willem.com/en/2019-03-31_wordpress-10-tips-to-secure-your-website/
Summary
Yes, unless you use remote publishing. In 2019 XML-RPC was effectively a backdoor that hackers attacked with brute force and special commands. I disabled it entirely, with the Disable XML-RPC plugin or a webserver rule in .htaccess.
Full text
XML-RPC exists so external services and apps can manage a WordPress site without logging in to wp-admin. That same convenience makes xmlrpc.php a favourite target: hackers try to break it with brute force and special commands, bypassing the normal login page. If you do not use remote publishing, disable the feature entirely with the Disable XML-RPC plugin, or block access to xmlrpc.php in the webserver with a .htaccess rule. I treat it the same way as the REST API: every remotely reachable management interface you do not use is attack surface you can simply remove. Hiding or IP-filtering the wp-admin login page closes the remaining front door, as long as you do not rely on that secrecy alone.