---
title: XML-RPC
canonical: https://wpsecurityninja.com/dictionary/xml-rpc/
---
# XML-RPC

XML-RPC is an older WordPress API endpoint attackers often abuse for brute force and amplification.

[Full guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/)

## FAQ

### When is it safe to disable XML-RPC?

When nothing you rely on needs it: classic mobile apps, some Jetpack features, or older automation. If those still depend on xmlrpc.php, restrict and rate-limit instead of a hard kill. Prefer modern REST API integrations with solid auth when you can migrate.

### Why do bots prefer XML-RPC over wp-login.php?

Multicall can pack many password attempts into one HTTP request, which bypasses naive per-request login limits. That makes xmlrpc.php a favorite for brute force and some amplification tricks.

## Why it matters for WordPress

`xmlrpc.php` can allow many password attempts in one HTTP request (multicall) and has been used in pingback-based floods. Plenty of modern sites do not need it. Leaving it open without limits is free attack surface.

## How it shows up in practice

- High traffic to `/xmlrpc.php` in access logs
- Brute-force attempts that barely touch the normal login form
- Jetpack, older mobile apps, or automation still calling XML-RPC (check before you disable)
- CPU spikes on cheap hosting from multicall storms

## What to do

1. Disable or block XML-RPC if nothing you use needs it.
2. If you need it, rate-limit and monitor closely.
3. Prefer the REST API with solid authentication for new integrations.
4. Confirm Jetpack, apps, and automation still work after any change.

## In WP Security Ninja

If you still need XML-RPC, keep [login protection](https://wpsecurityninja.com/login-protection/) limits on and consider cutting noisy abuse with the [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/). If nothing needs it, disable or block it at the host or firewall layer. Broader login hardening: [WordPress login security guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/).