Disable WordPress XML-RPC requests
WordPress uses an implementation of the XML-RPC protocol in order to extend functionality to software clients.
This Remote Procedure Calling protocol allows commands to be run, with data returned formatted in XML.
Beginning with WordPress 3.5 the XML-RPC functionality is enabled by default, without a way to disable.
Do I need WordPress XML-RPC?
Most users don't need WordPress XML-RPC functionality, and it's one of the most common causes for exploits.
All of the WordPress XML-RPC requests are remote POST requests to the xmlrpc.php script.
A full list of the different requests that can be made via XML-RPC can be found at XML-RPC WordPress API
Block WordPress xmlrpc.php requests with .htaccess
I want to send WordPress XML-RPC requests from my fictional IP address of 188.8.131.52.
So I can deny all requests to the xmlrpc.php file, except for that IP, using the following .htaccess rules:
# Block WordPress xmlrpc.php requests <Files xmlrpc.php> order deny,allow deny from all allow from 184.108.40.206 </Files>
If you didn't need any IP addresses to use XML-RPC requests, just don't use any allow lines.
We value your feedback!
There is a step or detail missing from the instructions.
The information is incorrect or out-of-date.
It does not resolve the question/problem I have.
new! - Enter your name and email address above and we will post your feedback in the comments on this page!
2015-02-27 4:49 pm
By completely blocking xmlrpc.php, isn't this also disabling the legitimate use of it for pingbacks?