PHP snippet · Security
Disable XML-RPC
Closes xmlrpc.php, the endpoint brute-force tools prefer and pingback floods reflect off, and removes the RSD link and X-Pingback header.
About this php snippet
xmlrpc.php is the single most probed file on a WordPress site. Its multicall method lets an attacker test hundreds of passwords in one request, which is why brute-force tools target it in preference to the login form, and its pingback method makes your site a reflector for traffic aimed at someone else.
Almost nothing needs it anymore. The REST API replaced it years ago, and most sites can close it and never notice.
What it does
- Disables XML-RPC and empties the method list, so the endpoint stops answering and stops enumerating what it supports
- Removes the RSD link from the page head and the X-Pingback header from every response, so the endpoint is no longer advertised
- Refuses pingbacks outright, including on posts that already have them open
Good to know
- Flipping the standard XML-RPC switch on its own still leaves the endpoint responding and listing its methods. Emptying the list is what actually closes it.
- Do not activate this if you use the legacy WordPress mobile apps, or an older remote publishing tool such as Windows Live Writer
- Jetpack talks to WordPress.com over XML-RPC, so check what you have connected before switching it on
- Requests still reach the file, and WordPress refuses them. Blocking xmlrpc.php at the web server or firewall as well saves the PHP boot, and the two work fine together.
