What Is XML-RPC in WordPress and Is It Still Needed?

XML-RPC is a remote procedure call protocol: a client POSTs an XML document naming a method and its parameters to xmlrpc.php, WordPress runs that method and returns an XML response. It is how remote tools published to WordPress before the REST API existed, and WordPress has shipped it switched on by default since version 3.5 (2012).

<?xml version="1.0"?>
<methodCall>
  <methodName>wp.getUsersBlogs</methodName>
  <params>
    <param><value><string>admin</string></value></param>
    <param><value><string>password</string></value></param>
  </params>
</methodCall>

Credentials travel inside the body of every authenticated call, which is part of why the endpoint attracts password guessing. Visiting the file in a browser sends a GET, so WordPress replies "XML-RPC server accepts POST requests only." That message means the endpoint is live, not broken.

Bots target xmlrpc.php for two reasons: it accepts login credentials outside the normal login form, and pingback.ping makes your server fetch any URL the caller supplies.

• Password guessing: each POST can test credentials without loading wp-login.php, bypassing login-page CAPTCHAs and some lockout plugins.
• system.multicall: packs many method calls into one request. Since WordPress 4.4, a failed login inside a multicall makes the remaining logins in that request fail, which blunted the "hundreds of guesses per request" trick, but every request still costs PHP time.
• Pingback abuse: your server can be told to request internal addresses (probing) or a third-party site (reflection in a flood).
• Resource drain: thousands of POSTs a day keep PHP workers busy even when every guess fails, which slows small shared plans.

You can see whether this is happening on your site by counting requests in the access log: grep -c "POST /xmlrpc.php" access.log. Reading those logs is covered in Apache log files explained.

For most sites, no: if you publish only through wp-admin and do not run Jetpack or a desktop editor, you can block XML-RPC with no visible change. Keep it, restricted to the services that use it, if Jetpack is connected or an editorial tool depends on MetaWeblog methods.

There are three levels of response. Block xmlrpc.php at the web server so requests never reach PHP; disable only pingbacks if a client still needs authenticated methods; or allow Jetpack's IP ranges and deny everyone else. The WordPress xmlrpc_enabled filter alone only disables authenticated methods and leaves pingbacks answering, so it is not a complete block. Step-by-step code for each option, with tests, is in how to disable XML-RPC in WordPress.