Snippet

Disable XML-RPC in WordPress

XML-RPC is an old way for apps and other websites to talk to WordPress. It lives in the xmlrpc.php file and it is turned on by default. Today, most of that work is done by the REST API, so many websites don’t use XML-RPC at all. Attackers still love it though, because they can try a lot of passwords in a single request, or misuse pingbacks to flood other websites. If nothing on your website depends on it, you can turn it off using the following code. For other methods, read our guide on how to enable or disable XML-RPC in WordPress.

Where to place? functions.php of your child theme, or a code snippets plugin.

Some apps and plugins still connect to WordPress through XML-RPC. Before you add this code, make sure nothing you use depends on it. If something stops working afterwards, simply remove the code.

Usage

  • To stop password-guessing attacks that go through xmlrpc.php instead of the login page.
  • To keep your website from being used in pingback attacks against other websites.
  • On websites that don’t use remote publishing tools or any plugin that needs XML-RPC.

Code


// Turn off the XML-RPC methods that need a username and password
add_filter( 'xmlrpc_enabled', '__return_false' );

// Remove the pingback methods too, as they work without logging in
function wpt_remove_xmlrpc_pingback( $methods ) {
  unset( $methods['pingback.ping'], $methods['pingback.extensions.getPingbacks'] );
  return $methods;
}
add_filter( 'xmlrpc_methods', 'wpt_remove_xmlrpc_pingback' );

The xmlrpc.php file still answers requests, but it can no longer be used to log in, publish or send pingbacks. If you want to block the file completely, you can do it at the server level instead.

Explanation

  1. A comment for the first part of the code.
  2. Using the built-in __return_false function on the xmlrpc_enabled filter. This switches off every XML-RPC method that needs a login, such as publishing posts or checking passwords.
  3. A comment for the second part.
  4. Declaring the wpt_remove_xmlrpc_pingback function and passing $methods, the list of everything XML-RPC offers.
  5. Removing the two pingback methods from that list with unset().
  6. Returning the shorter list.
  7. Closing the function.
  8. Adding our function to the xmlrpc_methods filter, so WordPress uses the shorter list.

Keep reading