XML-RPC

XML-RPC is an old WordPress feature that lets other apps post to your site without the normal login screen. Attackers often target it with login attempts. It was built before modern interfaces existed. Today it is rarely needed on a normal business site, yet it is switched on by default.

What is XML-RPC?

XML-RPC is a remote interface reachable through the file xmlrpc.php. Apps and services use it to post content and manage a site without using the admin screen.

XML-RPC is a protocol in which a program sends a request written in XML to a web address and gets an answer in XML. In WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. the address is xmlrpc.php in the site root. A client can authenticate with a username and password and then create posts, upload media or read data.

It was important when blogging apps and publishing tools needed a way to talk to a site. WordPress later added the REST API, which is the interface current features use. XML-RPC stayed for compatibility, and many sites still expose it without anyone using it.

What XML-RPC means for your PHP site

Every public endpoint that accepts logins is part of your attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server.. Because xmlrpc.php sits at the same address on every WordPress site, bots do not need to search for it. They try it against huge numbers of sites. Requests can also be batched, so a bot can attempt several passwords per request, and that can push load onto your server.

Having it enabled is not a vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. in itself. The risk is weak or reused passwords, accounts that are not needed, and a server that has to run PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. for every request the bot sends. Each request to xmlrpc.php starts WordPress, which costs server resources even when the login fails.

How to check and decide

Look in your access logs for requests to xmlrpc.php. Many hits from the same addresses with POST requests suggest automated attempts. Then ask what depends on it: a mobile app, a publishing tool, a backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. or management service, or an old plugin. If none of those apply, you can block access safely. If one does, restrict it to the addresses that need it, or replace the tool with one that uses the REST API.

Blocking can be done in the web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. configuration, in a security plugin or by a firewall rule in front of the site. After any change, test the things you rely on, then confirm that a request to xmlrpc.php no longer returns a working response. Set strong, unique passwords and add a second login step for every admin account, whatever you decide about XML-RPC.

Response headers can add another layer. See security headersSecurity headers are hidden instructions your site sends with each page that tell the visitor's browser which protections to switch on. for what they cover, and note that they do not replace blocking an unneeded interface.

When XML-RPC is a reason to rebuild

If xmlrpc.php, the login page and several pluginsA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. all exist to run a site whose content rarely changes, the cleaner answer is to remove the application from the public server. A static siteA static website is made of ready-made page files that the server hands over as they are, with no PHP code or database working behind the scenes. has no WordPress login, no xmlrpc.php and no database to query during a page view. That gives a smaller attack surface, though forms, hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. accounts and build tools still need protection. This is what our WordPress to static site service delivers.

When to act

Act when your logs show steady traffic to xmlrpc.php, when your server slows under login attempts, or when you realize nobody uses the interface. If the site already shows signs of a break-in, such as unknown admin users or odd files, ask us to fix your WordPress website.