Should You Disable XML-RPC on WordPress?

XML-RPC is a remote interface that predates the REST API. Security guides tell you to disable it; something on your site may stop working if you do. Both are true, and which matters depends on what you actually use.

Why it gets flagged

Two reasons. The first is system.multicall, which lets a single HTTP request contain many method calls — and therefore many login attempts. That turns a slow brute-force into a fast one and defeats naive rate limiting.

The second is pingbacks, which can be used to make your site issue requests to a target of the attacker’s choosing, turning it into a small participant in a reflection attack.

What still uses it

Thing	Uses XML-RPC?
Jetpack	Historically yes; newer versions prefer the REST API.
WordPress mobile app	Older versions yes; current versions prefer REST.
Some backup and management services	Varies. Check the vendor’s documentation.
Third-party publishing tools	Older desktop editors, yes.
Pingbacks and trackbacks	Yes, and most sites do not want these anyway.

Check before you decide

Rather than guessing, look at your access log for requests to xmlrpc.php and see what is calling it and how often:

grep xmlrpc.php access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

A long tail of many different addresses making repeated requests is attack traffic. A small number of consistent addresses is a service you use.

The middle option, which is usually right

Rather than disabling the whole interface, disable the two risky parts and leave the rest working:

// Remove the pingback method and multicall amplification
add_filter( 'xmlrpc_methods', function ( $methods ) {
    unset( $methods['pingback.ping'] );
    unset( $methods['pingback.extensions.getPingbacks'] );
    unset( $methods['system.multicall'] );
    return $methods;
} );

// Stop advertising the pingback endpoint
add_filter( 'wp_headers', function ( $headers ) {
    unset( $headers['X-Pingback'] );
    return $headers;
} );

Disabling it entirely

If nothing you use needs it, blocking it at the server level is better than filtering it in PHP, because the request never reaches WordPress:

# Nginx
location = /xmlrpc.php {
    deny all;
}

# Apache
<Files xmlrpc.php>
  Require all denied
</Files>

Common questions

Will disabling it break my site?

Not the site itself. It may break a connected service, which is why checking the log first is worth the two minutes.

Is the REST API the same risk?

No. The REST API requires proper authentication for write operations and has no equivalent of multicall amplification. It has its own considerations but not this one.

Do I still need rate limiting if I disable it?

Yes. wp-login.php remains a target. Disabling XML-RPC closes one door, not all of them.