{
 "id": 69746,
 "slug": "disabling-xml-rpc-in-wordpress",
 "url": "https://agents.willem.com/en/snippets/disabling-xml-rpc-in-wordpress/",
 "language": "en",
 "title": "Disabling XML-RPC in WordPress",
 "subtitle": "Close the xmlrpc.php backdoor before someone brute forces it.",
 "summary": "Yes, unless you use remote publishing. In 2019 XML-RPC was effectively a backdoor that hackers attacked with brute force and special commands. I disabled it entirely, with the Disable XML-RPC plugin or a webserver rule in .htaccess.",
 "topics": [
  "cloud",
  "cyber-security",
  "hacking",
  "howto",
  "networking",
  "server",
  "web",
  "webdesign"
 ],
 "date": "2019-03-31",
 "published": "2019-03-31T00:00:00+01:00",
 "created": "2026-08-30T07:13:21.205000+02:00",
 "updated": "2026-08-30T07:16:46.915000+02:00",
 "full_article_url": "https://willem.com/en/2019-03-31_wordpress-10-tips-to-secure-your-website/",
 "author": {
  "name": "Willem L. Middelkoop",
  "url": "https://willem.com"
 },
 "note": "A short distillation of a longer willem.com post. Not currently published on willem.com itself.",
 "answers_question": "Should you disable xmlrpc.php in WordPress?",
 "text": "XML-RPC exists so external services and apps can manage a WordPress site without logging in to wp-admin. That same convenience makes xmlrpc.php a favourite target: hackers try to break it with brute force and special commands, bypassing the normal login page.\nIf you do not use remote publishing, disable the feature entirely with the Disable XML-RPC plugin, or block access to xmlrpc.php in the webserver with a .htaccess rule.\nI treat it the same way as the REST API: every remotely reachable management interface you do not use is attack surface you can simply remove. Hiding or IP-filtering the wp-admin login page closes the remaining front door, as long as you do not rely on that secrecy alone.",
 "markdown_url": "https://agents.willem.com/en/snippets/disabling-xml-rpc-in-wordpress/snippet.md"
}