WordPress XML-RPC: The Hidden Door Hackers Are Still Using to Brute-Force Your Site in 2026

What Is XML-RPC and Why Does It Still Exist?

XML-RPC was created to allow remote applications — desktop blogging clients like Windows Live Writer, the WordPress mobile app, and Jetpack — to interact with your WordPress site without going through the web interface.

It was introduced in WordPress 2.6 (2008). Today, fewer than 2% of WordPress sites actively use it for a legitimate purpose. But it's still enabled by default in every WordPress installation, and it still responds to requests from the entire internet.

The file responsible is xmlrpc.php, sitting in your WordPress root directory.

---

The Attack: 500 Password Guesses in One Request

The problem isn't just that XML-RPC accepts login attempts. It's that it accepts them in batches.

WordPress's system.multicall method allows a single HTTP request to contain hundreds of individual API calls. Attackers use this to bundle password guesses:

<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
  <methodName>system.multicall</methodName>
  <params><param><value><array><data>
    <!-- 500 separate wp.getUsersBlogs calls, each with a different password: -->
    <value><struct>
      <member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
      <member><name>params</name><value><array><data>
        <value><string>admin</string></value>
        <value><string>password1</string></value>
      </data></array></value></member>
    </struct></value>
    <!-- ... 499 more attempts ... -->
  </data></array></value></param></params>
</methodCall>

Your login attempt limiter plugin — Limit Login Attempts Reloaded, WP Cerber, whatever you're using — is watching wp-login.php. It doesn't see XML-RPC requests. The attacker bypasses it entirely.

500 guesses per request. Automated. Potentially thousands of requests per minute from botnet IPs.

Source: Medium — The Hidden Danger in WordPress: XML-RPC Brute-Force 2025

---

Check If Your XML-RPC Is Exposed Right Now

Quick Manual Check

Open your browser and visit:

https://yourdomain.com/xmlrpc.php

If you see: "XML-RPC server accepts POST requests only." — your XML-RPC is open and accessible.

If you get a 403 Forbidden or 404, it's blocked.

External Scan (Also Checks User Enumeration)

Run: wp-scan.org/malware-check

The scan checks both XML-RPC exposure AND user enumeration (the twin vulnerability covered below) in a single pass, from outside your server.

---

How to Disable XML-RPC (3 Methods)

Method 1: .htaccess (Apache — Most Reliable)

# Add to your .htaccess file in the WordPress root:
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>

This blocks all access to xmlrpc.php at the server level, before WordPress even loads. It's the most effective approach.

Method 2: Nginx Config

# Add to your Nginx server block:
location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

Method 3: WordPress Filter (Plugin-Level)

// Add to your theme's functions.php or a custom plugin:
add_filter('xmlrpc_enabled', '__return_false');

Note: This disables XML-RPC at the WordPress level but the file still responds (with an error). Methods 1 or 2 are preferred because they prevent the server from serving the request at all.

---

When You Actually Need XML-RPC

Before disabling, check if anything depends on it:

You need XML-RPC if you use:

• •The WordPress iOS or Android app (most users switched to the web app)


• •Jetpack's older sync features (most are now REST API based)


• •A desktop blogging client like Windows Live Writer or MarsEdit


• •IFTTT or Zapier WordPress integrations (some use XML-RPC)

If you're unsure: Disable it for 2 weeks and see if anything breaks. Nothing will break for 98% of WordPress sites.

If you do need it: Whitelist only the specific IPs that legitimately use it:

<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
    Allow from 192.0.2.100    # Jetpack server IP
    Allow from YOUR.IP.ADDRESS  # Your office IP
</Files>

---

User Enumeration: The Twin Vulnerability

XML-RPC is most dangerous when combined with user enumeration — another exposure that's enabled by default in WordPress.

WordPress's REST API exposes your admin username at:

https://yourdomain.com/wp-json/wp/v2/users

An attacker harvests your admin username from this endpoint, then uses XML-RPC to brute-force the password. They skip half the work.

Fix user enumeration:

// Block the REST API user endpoint for unauthenticated requests:
add_filter('rest_endpoints', function($endpoints) {
    if (!is_user_logged_in()) {
        unset($endpoints['/wp/v2/users']);
        unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
    }
    return $endpoints;
});

Also block the author query enumeration:

// Block ?author=1 username harvesting:
add_action('template_redirect', function() {
    if (is_author() && isset($_GET['author'])) {
        wp_redirect(home_url(), 301);
        exit;
    }
});

Verify: Run wp-scan.org/malware-check — the scan explicitly checks both XML-RPC exposure and user enumeration and reports pass/fail for each.

---

The Full Login Hardening Stack

Beyond XML-RPC and user enumeration, a properly hardened WordPress login requires:

Implementing all 6 reduces unauthorized admin access attempts by over 95%.

---

The Two-Minute Fix

Check if you're exposed, fix it, verify it worked — all in about two minutes:

1. 1Check: Visit yourdomain.com/xmlrpc.php or run wp-scan.org/malware-check
2. 2Fix: Add the .htaccess block above
3. 3Verify: Re-run the scan — XML-RPC should now show as protected

Done. You've closed one of the most actively exploited access vectors in WordPress.

→ Check your XML-RPC exposure at wp-scan.org/malware-check

Free external scan — 22 checks, instant report. No plugin, no account.

Run Free Scan → wp-scan.org/malware-check

Tags: xml-rpc wordpress xmlrpc.php disable wordpress brute force wordpress login security wordpress hardening xmlrpc vulnerability

📬 Enjoyed this article?

Get the next one in your inbox — free WordPress security guides, weekly.

Subscribe