Disable XML-RPC

Last updated: 10th July 2026 for CC Security Essentials version 1.0

What is XML-RPC?

XML-RPC is a remote communication protocol built into WordPress.

It allows external applications to communicate with your website over the internet, enabling actions such as publishing posts, managing comments and performing other administrative tasks without using the WordPress dashboard.

Although XML-RPC was once an important part of WordPress, many websites no longer depend on it because modern integrations typically use the WordPress REST API instead.

Why Would I Disable XML-RPC?

If your website doesn’t use XML-RPC, disabling it can reduce your website’s attack surface.

Historically, XML-RPC has been targeted by attackers attempting to:

  • perform brute-force login attacks
  • amplify distributed denial-of-service (DDoS) attacks
  • probe websites for vulnerabilities

Disabling XML-RPC removes an unnecessary entry point for many websites while having little or no impact on normal day-to-day use.

When Should I Enable This Protection?

For most modern WordPress websites, disabling XML-RPC is a sensible security improvement.

This is particularly true for:

  • business websites
  • brochure websites
  • blogs managed through the WordPress dashboard
  • portfolio websites
  • e-commerce websites that don’t rely on XML-RPC

Many website owners will never notice any difference after disabling XML-RPC.

When Might I Leave XML-RPC Enabled?

Some applications and services still rely on XML-RPC.

You may need to leave it enabled if you use:

  • older desktop publishing software
  • legacy mobile applications
  • third-party services that specifically require XML-RPC
  • custom software written to communicate using XML-RPC

If you’re unsure whether your website depends on XML-RPC, it’s usually safe to disable it and test any services you use afterwards.

Should a legitimate service stop working, you can simply re-enable XML-RPC.

How to Disable XML-RPC

To disable XML-RPC:

  1. Open CC Security Essentials.
  2. Navigate to XML-RPC.
  3. Enable Disable XML-RPC.
  4. Save your changes.

The protection takes effect immediately.

Verifying That XML-RPC Is Disabled

One of the distinguishing features of CC Security Essentials is its built-in verification system.

After enabling XML-RPC protection:

  1. Open Verification.
  2. Run the XML-RPC Verification test.
  3. Review the results.

If the verification succeeds, you can be confident that your website is rejecting XML-RPC requests as expected.

Verification provides greater assurance than simply confirming that the setting has been enabled.

What Happens Behind the Scenes?

When XML-RPC protection is enabled, your website refuses XML-RPC requests before they can be processed by WordPress.

Visitors browsing your website won’t notice any difference.

Only applications attempting to communicate using XML-RPC are affected.

Troubleshooting

A service stopped working

If an application can no longer communicate with your website after disabling XML-RPC, check whether it depends on XML-RPC.

Many modern applications support the WordPress REST API instead and can be reconfigured accordingly.

If XML-RPC is genuinely required, you can simply re-enable it.

Verification Failed

If the XML-RPC verification test doesn’t produce the expected result:

  • ensure the protection has been enabled
  • save your settings again
  • clear any website or server caches
  • rerun the verification
  • review the Diagnostics page for additional information

If another security plugin also manages XML-RPC, the verification result may reflect the combined behaviour of both plugins.

Another Plugin Already Disables XML-RPC

Some security plugins and hosting providers disable XML-RPC automatically.

Using multiple plugins to control the same feature isn’t usually harmful, but it can make troubleshooting more difficult.

Where practical, it’s often preferable for a single plugin to manage a particular security feature.

Frequently Asked Questions

Will visitors notice any difference?

No.

Disabling XML-RPC has no effect on normal website visitors browsing your website.

Does this affect the WordPress dashboard?

No.

Administrators continue to use the WordPress dashboard normally.

XML-RPC is separate from the standard administrative interface.

Does this disable the REST API?

No.

XML-RPC and the WordPress REST API are separate technologies.

CC Security Essentials provides independent controls for REST API protection.

Can I re-enable XML-RPC later?

Yes.

Simply return to the XML-RPC settings and disable the protection if you need to restore XML-RPC functionality.

Best Practice

For most websites we recommend:

  • Disable XML-RPC.
  • Run the XML-RPC verification test.
  • Confirm that any applications you use continue to function normally.
  • Review the setting periodically if your website’s requirements change.

This approach provides a straightforward security improvement while allowing you to restore XML-RPC if it becomes necessary in the future.

Related Articles

Continue with: