Blog · WebJi® India

Disable XML-RPC in WordPress

Quick answer

To disable XML-RPC in WordPress fully, deny xmlrpc.php at the web server: a Files block with Require all denied in .htaccess, or a location deny on Nginx, so requests get 403 Forbidden before PHP runs. Plugins and the xmlrpc_enabled filter only refuse login methods. Do not delete the file, and allow Jetpack's IPs if you use Jetpack.

For WordPress owners who have decided XML-RPC is not needed and want a block that really stops the file, with a test to prove it.

✓ In business since 2005

✓ INR + GST billing

✓ 24/7 Email Support — avg reply < 60 min

Get Started View Plans

GuideWebJi®
knowledge

Read time: 4 min
Sections: 7
Updated: 14 Nov 2026
Written by: WebJi® team

Last editorial update: 14 November 2026.

Which way of disabling XML-RPC actually stops it?

Only a web-server rule that denies xmlrpc.php stops the file before PHP runs; WordPress filters and plugins leave the endpoint answering, and deleting the file lasts only until the next update. Pick the method by the result you need.

Methods to disable XML-RPC and what each really does
Method	Effect	Test result on POST /xmlrpc.php
`.htaccess` deny (Apache, LiteSpeed)	Server refuses the file; PHP never runs	403 Forbidden
Nginx `location` deny	Same, on Nginx servers	403 Forbidden
CDN or WAF rule (e.g. Cloudflare)	Blocked before reaching your server	403 or the CDN's block page
`xmlrpc_enabled` filter or "Disable XML-RPC" plugin	Authenticated methods refused; pingbacks still answered	200 with an XML fault for login calls
Filter that removes pingback methods	Stops pingback abuse, keeps other methods	200; pingback calls fault
Deleting `xmlrpc.php`	Gone until WordPress updates core	404, then back to 200 after an update

Not sure whether anything on your site still needs XML-RPC? Check first with what XML-RPC is and what still uses it; Jetpack and some desktop editors do.

Block xmlrpc.php in .htaccess (Apache and LiteSpeed)

Add a <Files> block at the top of .htaccess, above the # BEGIN WordPress section, that denies xmlrpc.php to everyone.

# Block WordPress XML-RPC
<Files "xmlrpc.php">
    Require all denied
</Files>

In cPanel File Manager, open the folder with wp-config.php (usually public_html) with hidden files shown, and download a copy of .htaccess.
Paste the block at the top and save.
Test from your own computer (command below). Expect 403.
If the whole site shows a 500 error, the server is running the old Apache 2.2 syntax; replace Require all denied with Order allow,deny and Deny from all on two lines.

Keeping custom rules outside the WordPress markers stops them being overwritten when permalinks are saved. Locating the file is covered in where .htaccess is in cPanel, and the .htaccess generator can build the block for you.

Block XML-RPC on Nginx or at a CDN

Nginx ignores .htaccess, so add an exact-match location block to the site's server configuration; on Cloudflare, a custom WAF rule can block the path before traffic reaches your server.

# inside the server { } block for the site
location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

sudo nginx -t && sudo systemctl reload nginx

For Cloudflare, create a custom rule with the expression (http.request.uri.path eq "/xmlrpc.php") and the action Block. That also keeps the junk requests out of your server logs and PHP workers.

Keep Jetpack working while blocking everyone else

If Jetpack is connected, allow only the IP ranges Jetpack publishes for its servers and deny every other address. Copy the current ranges from Jetpack's own allowlist documentation, because they change over time.

<Files "xmlrpc.php">
    # replace with the ranges from Jetpack's IP allowlist page
    Require ip 192.0.2.0/24
    Require ip 198.51.100.0/24
</Files>

The example uses documentation-only IP blocks; they must be replaced. After saving, open Jetpack → Dashboard and confirm the connection test passes. If Jetpack reports a broken connection, the ranges are incomplete.

Disable XML-RPC with code or a plugin when you cannot edit the server

If you cannot change .htaccess or the server, a small must-use plugin can refuse authenticated methods, remove pingbacks and stop advertising the endpoint; it reduces abuse but the file still runs.

<?php
// wp-content/mu-plugins/no-xmlrpc.php
add_filter( 'xmlrpc_enabled', '__return_false' );

add_filter( 'xmlrpc_methods', function ( $methods ) {
    unset( $methods['pingback.ping'], $methods['pingback.extensions.getPingbacks'] );
    return $methods;
} );

add_filter( 'wp_headers', function ( $headers ) {
    unset( $headers['X-Pingback'] );
    return $headers;
} );

remove_action( 'wp_head', 'rsd_link' );

Files in wp-content/mu-plugins load automatically and cannot be switched off from the Plugins screen, which suits a security setting. The free "Disable XML-RPC" plugin applies only the first filter. Brute-force attempts through the login form need separate protection; see limiting login attempts.

How to confirm XML-RPC is blocked

Send a POST to xmlrpc.php from outside the server and read the status code: 403 means the server block works, while 200 means PHP is still answering.

curl -s -o /dev/null -w "%{http_code}\n" -X POST https://www.example.in/xmlrpc.php
# 403 = blocked by the server   200 = file still runs (filter or plugin only)

Test both www and non-www hosts.
Load a normal post and /wp-admin to make sure only that one URL changed.
Over the next days, grep -c "POST /xmlrpc.php" access.log should show the requests answered with 403; Apache log reading is in Apache log files explained.

On WebJi® WordPress hosting, if you would rather not edit server files, email support@webji.services and ask for /xmlrpc.php to be denied for your domain; support replies 24/7 in Hindi and English. A wider review of plugins, logins and file permissions is part of WordPress security services.

FAQ

Frequently asked questions

Will blocking xmlrpc.php break the WordPress mobile app?

Current WordPress and Jetpack apps can connect to self-hosted sites over the REST API with application passwords, so usually not. If the app fails to connect after the block, check whether it is logging in through Jetpack, which does need XML-RPC.

Why does my security scanner still report XML-RPC after I installed a plugin?

Because the plugin only refuses certain methods; the file still answers with HTTP 200, which scanners treat as enabled. Add the server-level deny, and the scanner should see 403.

Should I block XML-RPC in both .htaccess and a plugin?

The server rule alone is enough because PHP never runs. Adding a plugin as well does no harm, but it makes troubleshooting harder later, for example when Jetpack needs access restored. Keep one documented block.

Does blocking XML-RPC stop all brute-force attacks?

It closes one route. Attackers also target wp-login.php and sometimes the REST API's user endpoints, so combine the block with strong passwords, two-factor authentication and login rate-limiting; the WordPress security checklist lists the rest.

Checked 15 November 2026 against WordPress developer documentation, Apache 2.4 and Nginx docs · Reviewed by the WebJi® team, Jaipur.

WebJi® since 2005

Ready to get started with WebJi®?

Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.

Talk to an Expert Compare Plans