{"id":4927,"date":"2021-03-06T21:55:19","date_gmt":"2021-03-06T21:55:19","guid":{"rendered":"https:\/\/chemicloud.com\/kb\/?post_type=ht_kb&#038;p=4927"},"modified":"2024-10-16T09:26:53","modified_gmt":"2024-10-16T09:26:53","slug":"disable-xmlrpc-php-on-wordpress","status":"publish","type":"ht_kb","link":"https:\/\/chemicloud.com\/kb\/article\/disable-xmlrpc-php-on-wordpress\/","title":{"rendered":"How to Disable xmlrpc.php on WordPress"},"content":{"rendered":"<p>XML-RPC for WordPress was designed to enable remote connections between your website and external applications, like WordPress for iOS or Android. This was useful in the early days of the internet when a person would choose to edit content offline, then connect to their blog later to publish, but now with the way Drafts work, typically this is no longer needed.<\/p>\n<p>This KB Article will instruct you on 2 methods of disabling XML-RPC.<\/p>\n<h3 id=\"why-should-i-disable-xml-rpc\" class=\"h3 u-textAllcaps\">Why should I disable XML-RPC?<\/h3>\n<p>As this feature is needed less and less, security risks are associated with leaving it enabled. These can include, but are not limited to in scope:<\/p>\n<ul>\n<li><strong>Brute Force Attacks &#8211;\u00a0<\/strong>Where an attacker can use xml-rpc to test hundreds of username and password combinations until they are eventually able to gain access to your site. This occurs because xml-rpc does not have the same login attempt limit when you normally log into WordPress.<\/li>\n<li><strong>DDoS Attack<\/strong>\u00a0&#8211; Where an attacker can use xml-rpc to pingback thousands of IPs. This allows them to send a flood of data and traffic which can cause overages and even have networks paralyzed and shutdown.<\/li>\n<\/ul>\n<h3 id=\"how-to-disable-xml-rpc-using-a-plugin\">How to Disable XML-RPC Using a Plugin<\/h3>\n<p>The easiest way to disable XML-RPC is to use a plugin.<\/p>\n<p>Step 1: Login to your \/wp-admin and hover over Plugins from the menu on the left side. In the little menu that appears, click Add New:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4928\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/1-2-702x783.jpg\" alt=\"\" width=\"452\" height=\"504\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/1-2-702x783.jpg 702w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/1-2-269x300.jpg 269w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/1-2-768x857.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/1-2-45x50.jpg 45w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/1-2-54x60.jpg 54w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/1-2-90x100.jpg 90w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/1-2.jpg 864w\" sizes=\"auto, (max-width: 452px) 100vw, 452px\" \/><\/p>\n<p>Step 2: Use the search box in the top right corner and search for &#8220;Disable XML-RPC&#8221; (without the quotes). Find the Disable XML-RPC-API plugin by Neatmarketing and click the Install Now button in the search results.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4929\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2-783x303.jpg\" alt=\"\" width=\"643\" height=\"249\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2-783x303.jpg 783w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2-300x116.jpg 300w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2-768x298.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2-50x19.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2-1536x595.jpg 1536w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2-60x23.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2-100x39.jpg 100w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/2-2.jpg 1918w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>Once the plugin is installed, click the Blue activate button:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4930\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2-783x298.jpg\" alt=\"\" width=\"643\" height=\"245\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2-783x298.jpg 783w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2-300x114.jpg 300w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2-768x292.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2-50x19.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2-1536x585.jpg 1536w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2-60x23.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2-100x38.jpg 100w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/3-2.jpg 1918w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>By clicking activate, your site will be protected from XML-RPC attacks, and XML-RPC will be disabled.<\/p>\n<p class=\"p1\"><b>Exciting News: Introducing Our fastest <\/b><a href=\"https:\/\/chemicloud.com\/managed-wordpress-hosting?utm_source=blog&amp;utm_medium=article#60b65e4e63b58\"><b>WordPress Hosting<\/b><\/a><b> stack <\/b><span class=\"s1\">\ud83d\ude80<\/span><b> Ready for speed? Try it for just $1!<\/b><\/p>\n<h3 id=\"how-to-disable-xml-rpc-using-htaccess\">How to Disable XML-RPC Using .htaccess<\/h3>\n<p>Suppose you&#8217;d prefer not to increase the memory footprint of your WordPress installation or worry about managing another plugin. In that case, you can use the .htaccess to disable XML-RPC on your WordPress site.<\/p>\n<p><strong>Step 1:<\/strong> Login to your cPanel. There are a lot of ways to do this, but the sure-fire easiest way is to log in to your <a href=\"https:\/\/lab.chemicloud.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Client Area<\/a>, then open your cPanel.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4061\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab.jpg\" alt=\"\" width=\"1674\" height=\"496\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab.jpg 1674w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab-300x89.jpg 300w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab-1024x303.jpg 1024w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab-768x228.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab-50x15.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab-1536x455.jpg 1536w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab-60x18.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2020\/12\/lab-100x30.jpg 100w\" sizes=\"auto, (max-width: 1674px) 100vw, 1674px\" \/><\/p>\n<p>Step 2: Look in the Files section (1st section from the top) and click to open the File Manager.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4931\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2-783x256.jpg\" alt=\"\" width=\"643\" height=\"210\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2-783x256.jpg 783w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2-300x98.jpg 300w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2-768x251.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2-50x16.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2-1536x501.jpg 1536w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2-60x20.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2-100x33.jpg 100w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/4-2.jpg 1918w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>Step 3: Once the file manager is open, double click the globe icon to the left of your public_html folder.<\/p>\n    \t\t<div class=\"hts-messages hts-messages--alert  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Tip:<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\tIf you double click the text &#8220;public_html&#8221;, you will be given the option to edit the folder name. If this happens, just click anywhere in the whitespace to the left to close the edit mode.\u00a0    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4932\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-778x783.jpg\" alt=\"\" width=\"643\" height=\"647\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-778x783.jpg 778w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-298x300.jpg 298w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-150x150.jpg 150w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-768x773.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-50x50.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-1526x1536.jpg 1526w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-60x60.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5-100x100.jpg 100w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/5.jpg 1919w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>Step 4: Once your public_html folder is open, look for your .htaccess file:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4933\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6-783x249.jpg\" alt=\"\" width=\"643\" height=\"204\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6-783x249.jpg 783w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6-300x96.jpg 300w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6-768x245.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6-50x16.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6-1536x489.jpg 1536w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6-60x19.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6-100x32.jpg 100w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/6.jpg 1918w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>Click the file name once to highlight it. Then in the menu bar at the top, click Edit:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4934\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7-783x254.jpg\" alt=\"\" width=\"643\" height=\"209\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7-783x254.jpg 783w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7-300x97.jpg 300w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7-768x249.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7-50x16.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7-1536x499.jpg 1536w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7-60x19.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7-100x32.jpg 100w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/7.jpg 1918w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>In the editor modal that appears, click the Edit button in the lower right corner:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-4935\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/8.jpg\" alt=\"\" width=\"389\" height=\"271\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/8.jpg 761w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/8-300x209.jpg 300w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/8-50x35.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/8-60x42.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/8-100x70.jpg 100w\" sizes=\"auto, (max-width: 389px) 100vw, 389px\" \/><\/p>\n<p>Step 5: A new window will open with the context\/text of your .htaccess file.<\/p>\n<p>Paste the below text at the end of your .htaccess file, then click Save Changes in the top right.<\/p>\n<pre># BEGIN Block WordPress xmlrpc.php requests\r\n &lt;Files xmlrpc.php&gt;\r\n order deny,allow\r\n deny from all\r\n allow from xxx.xxx.xxx.xxx\r\n &lt;\/Files&gt;\r\n# END WordPress xmlrpc.php requests<\/pre>\n<div class=\"grid-col span8 ng-scope\">\n<div class=\"content\">\n<div class=\"content_all\">\n    \t\t<div class=\"hts-messages hts-messages--success  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Pro Tip:<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\tYou can replace\u00a0xxx.xxx.xxx.xxx\u00a0with an IP address you wish to give access to xmlrpc.php. If you wish to remove access completely, you can simply remove this line.    \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<\/div>\n<\/div>\n<\/div>\n<div class=\"grid-col push1 span3 u-hidden--sm u-hidden--xsm\">\n<div class=\"sidebar is_stuck\">\n<div class=\"sidebar__content\"><\/div>\n<\/div>\n<\/div>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4936\" src=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9-783x210.jpg\" alt=\"\" width=\"643\" height=\"172\" srcset=\"https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9-783x210.jpg 783w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9-300x81.jpg 300w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9-768x206.jpg 768w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9-50x13.jpg 50w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9-1536x412.jpg 1536w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9-60x16.jpg 60w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9-100x27.jpg 100w, https:\/\/chemicloud.com\/kb\/wp-content\/uploads\/2021\/03\/9.jpg 1918w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>You can close the editor tab after clicking Save Changes.<\/p>\n<p>Congrats! This will disable the XML-RPC features of your WordPress installation and you can rest easy!<\/p>\n<p>If you enjoyed this tutorial, then you\u2019ll love our support! All ChemiCloud\u2019s hosting plans include 24\/7 support from our amazing support team. Check out our <span class=\"s1\"><a href=\"https:\/\/chemicloud.com\/managed-wordpress-hosting?utm_source=blog&amp;utm_medium=article#60b65e4e63b58\"><b>Managed WordPress hosting<\/b><\/a><\/span><b> <\/b>\u00a0plans and have your website migrated today!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>XML-RPC for WordPress was designed to enable remote connections between your website and external applications, like WordPress for iOS or Android. This was useful in the early days of the internet when a person would choose to edit content offline, then connect to their blog later to publish, but now&#8230;<\/p>\n","protected":false},"author":10,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"ht-kb-category":[40],"ht-kb-tag":[],"class_list":["post-4927","ht_kb","type-ht_kb","status-publish","format-standard","hentry","ht_kb_category-wordpress"],"_links":{"self":[{"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb\/4927","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/comments?post=4927"}],"version-history":[{"count":6,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb\/4927\/revisions"}],"predecessor-version":[{"id":8480,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb\/4927\/revisions\/8480"}],"wp:attachment":[{"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/media?parent=4927"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb-category?post=4927"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb-tag?post=4927"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}