How to Disable XML-RPC in WordPress to Stop Brute-Force and Pingback Attacks

WordPress includes a file called xmlrpc.php that lets outside applications talk to your site: older mobile publishing apps, some plugins, and the pingback/trackback system that notifies other sites when you link to them. It's also one of the most commonly abused files on any WordPress install. Attackers use it to run brute-force login attempts in bulk (bypassing normal login lockouts) and to flood your server with pingback requests, which can slow your site down or trigger a resource-usage warning from your host.

If you don't rely on an old-style publishing app or a plugin that specifically needs XML-RPC, it's safe to disable it. Here are three ways to do it, from easiest to most hands-on.

Before you disable it

Check whether any plugin you use depends on XML-RPC before turning it off. Some older site-to-site notification tools and a handful of mobile app integrations still use it. If you're not sure, disabling it and checking that your site and plugins keep working normally is usually enough of a test; you can always reverse the change.

Method 1: Use a security plugin

Most WordPress security plugins include a simple toggle to block XML-RPC without editing any code. This is the easiest option if you already have one installed.

1. Log in to your WordPress admin dashboard.
2. Open your security plugin's settings (usually under its own menu item in the left sidebar).
3. Look for a firewall or "hardening" section and find the option to disable XML-RPC or block xmlrpc.php.
4. Enable it and save your settings.

Method 2: Block it with a .htaccess rule

If you don't use a security plugin, you can block external access to the file directly. This works the same way whether your hosting account uses cPanel or DirectAdmin, since you're editing a file in your site's root folder through File Manager.

1. Open File Manager and navigate to your WordPress site's root folder (usually public_html).
2. Open the .htaccess file for editing.
3. Add the following block near the top of the file, above the existing WordPress rules:

<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>

4. Save the file.

Method 3: Disable it with code

If you maintain a custom child theme or site-specific plugin, you can disable XML-RPC entirely with one line added to your theme's functions.php file:

add_filter('xmlrpc_enabled', '__return_false');

This stops WordPress itself from responding to XML-RPC requests, rather than just blocking access to the file at the server level.

How to check it worked

Visit yourdomain.com/xmlrpc.php in your browser. Before disabling it, you'll normally see a message like "XML-RPC server accepts POST requests only." After disabling it, you should see a 403 Forbidden error or a blank failure page, confirming it's blocked.

If you're still seeing repeated failed login attempts after disabling XML-RPC, see how to limit login attempts and protect your WordPress login from brute-force attacks for additional steps.