{"id":2825,"date":"2013-09-05T20:31:38","date_gmt":"2013-09-06T00:31:38","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2013\/09\/05\/disable-xml-rpc-requests\/"},"modified":"2021-08-12T17:25:10","modified_gmt":"2021-08-12T21:25:10","slug":"disable-xml-rpc-requests","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/","title":{"rendered":"Disable WordPress XML-RPC requests"},"content":{"rendered":"<p>WordPress uses an implementation of the <strong><a href=\"https:\/\/codex.wordpress.org\/XML-RPC_Support\" target=\"_blank\" rel=\"noopener noreferrer\">XML-RPC<\/a> protocol<\/strong> in order to extend functionality to software clients.<\/p>\n<p>This <strong>Remote Procedure Calling<\/strong> protocol allows commands to be run, with data returned formatted in <strong>XML<\/strong>.<\/p>\n<p>Beginning with <strong>WordPress 3.5<\/strong> the <strong>XML-RPC<\/strong> functionality is <strong>enabled by default<\/strong>, without a way to disable.<\/p>\n<h2>Do I need WordPress XML-RPC?<\/h2>\n<p>Most users don&#8217;t need <strong>WordPress XML-RPC<\/strong> functionality, and it&#8217;s one of the most common causes for exploits.<\/p>\n<p>Some clients such as the official <a href=\"https:\/\/wordpress.org\/mobile\/\" target=\"_blank\" rel=\"noopener noreferrer\">WordPress Mobile Apps<\/a> and <a href=\"https:\/\/blogger.com\" target=\"_blank\" rel=\"noopener noreferrer\">Blogger<\/a> use <strong>XML-RPC<\/strong> requests to function.<\/p>\n<p>All of the WordPress <strong>XML-RPC<\/strong> requests are remote <strong>POST<\/strong> requests to the <strong>xmlrpc.php<\/strong> script.<\/p>\n<p>A full list of the different requests that can be made via <strong>XML-RPC<\/strong> can be found at <a href=\"https:\/\/codex.wordpress.org\/XML-RPC_WordPress_API\" target=\"_blank\" rel=\"noopener noreferrer\">XML-RPC WordPress API<\/a><\/p>\n<h2>Block WordPress xmlrpc.php requests with .htaccess<\/h2>\n<p>I want to send WordPress <strong>XML-RPC<\/strong> requests from my fictional IP address of <strong style=\"color: red;\">123.123.123.123<\/strong>.<\/p>\n<p>So I can deny all requests to the <strong>xmlrpc.php<\/strong> file, except for that IP, using the following <strong>.htaccess<\/strong> rules:<\/p>\n\n\n<pre class=\"wp-block-preformatted\"># Block xmlrpc.php requests\n&lt;Files \"xmlrpc.php\">  \norder deny,allow \ndeny from all \nallow from 123.123.123.123\n&lt;\/Files><\/pre>\n\n\n\n<p>If you didn&#8217;t need any IP addresses to use <strong>XML-RPC<\/strong> requests, just don&#8217;t use any <strong>allow<\/strong> lines.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress uses an implementation of the XML-RPC protocol in order to extend functionality to software clients. This Remote Procedure Calling protocol allows commands to be run, with data returned formatted in XML. Beginning with WordPress 3.5 the XML-RPC functionality is enabled by default, without a way to disable. Do I need WordPress XML-RPC? Most users<a class=\"moretag\" href=\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/\"> Read More ><\/a><\/p>\n","protected":false},"author":57014,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4325,56],"tags":[],"class_list":["post-2825","post","type-post","status-publish","format-standard","hentry","category-wordpress-hosting","category-wordpress"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Disable WordPress XML-RPC requests | InMotion Hosting<\/title>\n<meta name=\"description\" content=\"WordPress uses the XML-RPC protocol to extend functionality to remote clients, and you can disable it if this isn&#039;t needed.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Disable WordPress XML-RPC requests | InMotion Hosting\" \/>\n<meta property=\"og:description\" content=\"WordPress uses the XML-RPC protocol to extend functionality to remote clients, and you can disable it if this isn&#039;t needed.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/\" \/>\n<meta property=\"og:site_name\" content=\"InMotion Hosting Support Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inmotionhosting\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-09-06T00:31:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-12T21:25:10+00:00\" \/>\n<meta name=\"author\" content=\"InMotion Hosting Contributor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/InMotionHosting\" \/>\n<meta name=\"twitter:site\" content=\"@InMotionHosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"InMotion Hosting Contributor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/\"},\"author\":{\"name\":\"InMotion Hosting Contributor\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\"},\"headline\":\"Disable WordPress XML-RPC requests\",\"datePublished\":\"2013-09-06T00:31:38+00:00\",\"dateModified\":\"2021-08-12T21:25:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/\"},\"wordCount\":185,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"articleSection\":[\"WordPress Hosting\",\"WordPress Tutorials\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/\",\"name\":\"Disable WordPress XML-RPC requests | InMotion Hosting\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\"},\"datePublished\":\"2013-09-06T00:31:38+00:00\",\"dateModified\":\"2021-08-12T21:25:10+00:00\",\"description\":\"WordPress uses the XML-RPC protocol to extend functionality to remote clients, and you can disable it if this isn't needed.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.inmotionhosting.com\/support\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Disable WordPress XML-RPC requests\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"name\":\"InMotion Hosting Support Center\",\"description\":\"Web Hosting Support &amp; Tutorials\",\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\",\"name\":\"InMotion Hosting\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"contentUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"width\":696,\"height\":696,\"caption\":\"InMotion Hosting\"},\"image\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/inmotionhosting\/\",\"https:\/\/x.com\/InMotionHosting\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\",\"name\":\"InMotion Hosting Contributor\",\"description\":\"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/inmotion-hosting\/\",\"https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting\"],\"url\":\"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Disable WordPress XML-RPC requests | InMotion Hosting","description":"WordPress uses the XML-RPC protocol to extend functionality to remote clients, and you can disable it if this isn't needed.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/","og_locale":"en_US","og_type":"article","og_title":"Disable WordPress XML-RPC requests | InMotion Hosting","og_description":"WordPress uses the XML-RPC protocol to extend functionality to remote clients, and you can disable it if this isn't needed.","og_url":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/","og_site_name":"InMotion Hosting Support Center","article_publisher":"https:\/\/www.facebook.com\/inmotionhosting\/","article_published_time":"2013-09-06T00:31:38+00:00","article_modified_time":"2021-08-12T21:25:10+00:00","author":"InMotion Hosting Contributor","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/InMotionHosting","twitter_site":"@InMotionHosting","twitter_misc":{"Written by":"InMotion Hosting Contributor","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/#article","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/"},"author":{"name":"InMotion Hosting Contributor","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644"},"headline":"Disable WordPress XML-RPC requests","datePublished":"2013-09-06T00:31:38+00:00","dateModified":"2021-08-12T21:25:10+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/"},"wordCount":185,"commentCount":0,"publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"articleSection":["WordPress Hosting","WordPress Tutorials"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/","url":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/","name":"Disable WordPress XML-RPC requests | InMotion Hosting","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#website"},"datePublished":"2013-09-06T00:31:38+00:00","dateModified":"2021-08-12T21:25:10+00:00","description":"WordPress uses the XML-RPC protocol to extend functionality to remote clients, and you can disable it if this isn't needed.","breadcrumb":{"@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.inmotionhosting.com\/support\/edu\/wordpress\/disable-xml-rpc-requests\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inmotionhosting.com\/support\/"},{"@type":"ListItem","position":2,"name":"Disable WordPress XML-RPC requests"}]},{"@type":"WebSite","@id":"https:\/\/www.inmotionhosting.com\/support\/#website","url":"https:\/\/www.inmotionhosting.com\/support\/","name":"InMotion Hosting Support Center","description":"Web Hosting Support &amp; Tutorials","publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.inmotionhosting.com\/support\/#organization","name":"InMotion Hosting","url":"https:\/\/www.inmotionhosting.com\/support\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/","url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","contentUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","width":696,"height":696,"caption":"InMotion Hosting"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inmotionhosting\/","https:\/\/x.com\/InMotionHosting"]},{"@type":"Person","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644","name":"InMotion Hosting Contributor","description":"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!","sameAs":["https:\/\/www.linkedin.com\/company\/inmotion-hosting\/","https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting"],"url":"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"primary_category":null,"_links":{"self":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/2825","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/users\/57014"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/comments?post=2825"}],"version-history":[{"count":3,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/2825\/revisions"}],"predecessor-version":[{"id":53356,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/2825\/revisions\/53356"}],"wp:attachment":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/media?parent=2825"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/categories?post=2825"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/tags?post=2825"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}