XML-RPC is an API that lets applications communicate with WordPress to manage content and perform other remote actions. When it is enabled, attackers can target it around the clock with repeated login attempts or use it to generate denial-of-service traffic.

How XML-RPC can be abused

Unlike the standard login page, XML-RPC can accept batched authentication requests. That can let an attacker test many username and password combinations in fewer requests. It can also be abused as part of traffic amplification and denial-of-service attacks.

If your site does not rely on XML-RPC, disable it. If a connected app or service needs it, ask your developer to restrict access to trusted IP addresses and monitor the endpoint.

Disable XML-RPC with BruteBank

The BruteBank WordPress plugin can disable the XML-RPC API. Sign in to WordPress admin, open the BruteBank plugin settings, and turn on Disable XMLRPC. Confirm that your mobile apps, publishing integrations, or other connected services do not depend on XML-RPC before disabling it.

Block requests at the web server

For an Apache server, you can deny requests to xmlrpc.php in the site's root .htaccess file:

<FilesMatch "^xmlrpc\.php$">
  Require all denied
</FilesMatch>

Server configuration varies. Test changes carefully, keep a backup of the original configuration, and use your host's guidance if your site runs Nginx or another web server.

Reduce the attack surface

  • Disable XML-RPC when your site and its integrations do not need it.
  • If it must remain enabled, restrict access to trusted sources where possible.
  • Use unique administrator passwords and enable two-factor authentication.
  • Monitor login activity and investigate unexpected traffic or successful logins.

Conclusion

XML-RPC is useful for some WordPress integrations, but it can expose another route for automated login attacks. Disable it when it is not needed, or limit access and monitor it when a service depends on it.