XML-RPC
Definition
XML-RPC is an older WordPress API endpoint attackers often abuse for brute force and amplification.
Also called: xmlrpc, xml rpc
Why it matters for WordPress
xmlrpc.php can allow many password attempts in one HTTP request (multicall) and has been used in pingback-based floods. Plenty of modern sites do not need it. Leaving it open without limits is free attack surface.
How it shows up in practice
- High traffic to
/xmlrpc.phpin access logs - Brute-force attempts that barely touch the normal login form
- Jetpack, older mobile apps, or automation still calling XML-RPC (check before you disable)
- CPU spikes on cheap hosting from multicall storms
What to do
- Disable or block XML-RPC if nothing you use needs it.
- If you need it, rate-limit and monitor closely.
- Prefer the REST API with solid authentication for new integrations.
- Confirm Jetpack, apps, and automation still work after any change.
In WP Security Ninja
If you still need XML-RPC, keep login protection limits on and consider cutting noisy abuse with the Cloud Firewall. If nothing needs it, disable or block it at the host or firewall layer. Broader login hardening: WordPress login security guide.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Brute force A brute-force attack tries many passwords or tokens until one works, usually against the login form.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- DDoS A DDoS attack floods a site or its infrastructure with traffic so legitimate visitors cannot get through.
- REST API The WordPress REST API is an HTTP JSON interface at /wp-json/ used by the editor, apps, and many plugins.
