WordPress-specific Dictionary
XML-RPC
Definition
XML-RPC is an older WordPress API endpoint attackers often abuse for brute force and amplification.
Also called: xmlrpc, xml rpc
Why it matters for WordPress
xmlrpc.php can allow many password attempts in one HTTP request (multicall) and has been used in pingback-based floods. Many sites do not need it anymore.
How it shows up in practice
- High traffic to
/xmlrpc.php - Brute-force attempts that bypass simple login form limits
- Mobile apps or Jetpack still relying on XML-RPC (check before disabling)
What to do
- Disable or block XML-RPC if nothing you use needs it.
- If you need it, rate-limit and monitor.
- Prefer the REST API with solid authentication for modern integrations.
- Confirm Jetpack, mobile apps, or automation still work after changes.
In WP Security Ninja
If you still need XML-RPC, keep login protection limits on and consider blocking noisy XML-RPC abuse with the Cloud Firewall. If nothing you use needs XML-RPC, disable or block it at the host or firewall layer.
Related terms
Nearby ideas in the dictionary
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- DDoS A DDoS attack floods a site or its infrastructure with traffic so legitimate visitors cannot get through.