Long before the REST API arrived, WordPress needed a way to talk to outside apps. That job went to XML-RPC, a feature that lets other programs publish and manage content on your site remotely.
Today, it is mostly known for security warnings. In this article, we will see what XML-RPC is, who still uses it and whether you should turn it off.
What is XML-RPC in WordPress?
XML-RPC is short for XML Remote Procedure Call. It is a protocol that sends requests and replies as XML over HTTP. In WordPress, all of this goes through a single file named xmlrpc.php in the root folder of your site.
Think of xmlrpc.php as a side door to your house. It is handy for trusted visitors, but you need to keep an eye on who is knocking.
XML-RPC has been enabled by default since WordPress 3.5, and there is no dashboard setting to switch it off.
Who Still Uses XML-RPC?
- Jetpack has long used it for parts of its connection with WordPress.com.
- Pingbacks use it to tell other blogs that you linked to them.
- Some older desktop and mobile blogging apps use it to publish posts.
Most modern tools have moved to the REST API, which is newer and more flexible.
Should You Disable XML-RPC?
Attackers like XML-RPC because one request can try many passwords at once, using a method called system.multicall. It can also be misused to send floods of pingbacks to other sites.
If you don't use Jetpack, pingbacks or a remote publishing app, it is pretty safe to disable it. You can do that with a plugin or, on Apache servers, a few lines in your .htaccess file. Read our guide on how to enable or disable XML-RPC in WordPress for the steps.
Before blocking xmlrpc.php, check whether any plugin or app on your site still needs it. Test Jetpack and your publishing tools after the change.
That's all about XML-RPC. It served WordPress well for years, but most sites can live without it today. Still have questions about xmlrpc.php? Leave them in the comment box below.