{"id":43772,"date":"2024-08-02T19:21:24","date_gmt":"2024-08-02T16:21:24","guid":{"rendered":"https:\/\/computingforgeeks.com\/?p=43772"},"modified":"2024-08-02T19:21:27","modified_gmt":"2024-08-02T16:21:27","slug":"how-to-disable-xmlrpc-php-access-in-wordpress","status":"publish","type":"post","link":"https:\/\/computingforgeeks.com\/how-to-disable-xmlrpc-php-access-in-wordpress\/","title":{"rendered":"How To Disable Xmlrpc.php access in WordPress"},"content":{"rendered":"\n<p>XML-RPC is WordPress feature that allows for data transfer over HTTP with XML being used as the encoding mechanism. It was initially created to facilitate WordPress communication with other systems. An example use case for this is posting to your site from a mobile device through a remote access feature enabled by <em>xmlrpc.php<\/em>.<\/p>\n\n\n\n<p>There have been recent security concerns related to XML-RPC and with the new WordPress API, the use of XML-RPC will be deprecated. Since there is less use of XML-RPC, it can be disabled entirely in your WordPress website.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Disable Xmlrpc.php in WordPress &#8211; Apache Web server<\/h2>\n\n\n\n<p>If you&#8217;re using an Apache webs server, you can open the site configuration file and disable access to <em>xmlrpc.php<\/em> from your users by adding the following block:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\"><em># Block access to WordPress xmlrpc.php\n<\/em><\/mark>&lt;Files xmlrpc.php>\n  Order Deny,Allow\n  Deny from all\n&lt;\/Files><\/code><\/pre>\n\n\n\n<p>If you want to allow access only from trusted network, add the IP address like below.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-purple-color\"># Block access to WordPress xmlrpc.php\n<\/mark>&lt;Files xmlrpc.php>\n  Order Deny,Allow\n  Deny from all\n  Allow from <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-cyan-blue-color\">x.x.x.x<\/mark>\n&lt;\/Files><\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Change <em>x.x.x.x<\/em> to the IP address will access <em>xmlrpc.php<\/em> from.<\/li>\n<\/ul>\n\n\n\n<p>Restart apache server after the change.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><em><span class=\"has-inline-color has-vivid-purple-color\">### Debian \/ Ubuntu ###\n<\/span><\/em>sudo systemctl restart apache2\n\n<meta charset=\"utf-8\"><em><span class=\"has-inline-color has-vivid-purple-color\">### CentOS \/ Fedora \/ RHEL <meta charset=\"utf-8\">###\n<\/span><\/em>sudo systemctl restart httpd<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Disable <code>xmlrpc.php<\/code> in WordPress &#8211; Nginx<\/h2>\n\n\n\n<p>For Nginx users, disable access to <em>xmlrpc.php<\/em> by adding a line to your web configuration fille which look like this: <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>location = \/xmlrpc.php {\n          deny all;\n          access_log off;\n          log_not_found off;\n}\n<\/code><\/pre>\n\n\n\n<p>Restart Nginx server after the change.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart nginx<\/code><\/pre>\n\n\n\n<p>If you try to access the PHP script, you should get a <em>403 Forbidden <\/em>error message.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Disable Xmlrpc.php in WordPress with Plugin<\/h2>\n\n\n\n<p>There are plugins which can help you disable <em>Xmlrpc.php<\/em> in WordPress. If you go to plugins section and search keyword &#8220;<strong>Disable XML-RPC<\/strong>&#8220;.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large td-caption-align-https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"452\" src=\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress-1024x452.png\" alt=\"\" class=\"wp-image-43819\" title=\"\" srcset=\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress-1024x452.png 1024w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress-300x132.png 300w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress-768x339.png 768w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress-696x307.png 696w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress-1068x472.png 1068w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress-951x420.png 951w, https:\/\/computingforgeeks.com\/wp-content\/uploads\/2020\/01\/disable-xmlrpc-wordpress.png 1171w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Other security plugins such as <em>Wordfence Security &#8211; Firewall &amp; Malware Scan<\/em> also gives an option to disable <strong> <\/strong><em>XML-RPC<\/em> on WordPress.<\/p>\n\n\n\n<p>More guides on Web:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/computingforgeeks.com\/best-free-and-open-source-web-hosting-control-panels\/\" target=\"_blank\" rel=\"noreferrer noopener\">Best Free and Open Source Web Hosting Control Panels<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/computingforgeeks.com\/host-wordpress-website-with-caddy-web-server\/\" target=\"_blank\" rel=\"noreferrer noopener\">How To Host WordPress website with Caddy Web Server<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/computingforgeeks.com\/install-drupal-on-debian-linux\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install Drupal 8 on Debian Linux<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/computingforgeeks.com\/best-commercial-web-hosting-control-panels\/\" target=\"_blank\" rel=\"noreferrer noopener\">Best Commercial Cpanel Alternatives<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>XML-RPC is WordPress feature that allows for data transfer over HTTP with XML being used as the encoding mechanism. It was initially created to facilitate WordPress communication with other systems. An example use case for this is posting to your site from a mobile device through a remote access feature enabled by xmlrpc.php. There have &#8230; <a title=\"How To Disable Xmlrpc.php access in WordPress\" class=\"read-more\" href=\"https:\/\/computingforgeeks.com\/how-to-disable-xmlrpc-php-access-in-wordpress\/\" aria-label=\"Read more about How To Disable Xmlrpc.php access in WordPress\">Read more<\/a><\/p>\n","protected":false},"author":3,"featured_media":4973,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[299,50,349],"tags":[240],"class_list":["post-43772","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-how-to","category-linux-tutorials","category-web-hosting","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/43772","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/comments?post=43772"}],"version-history":[{"count":1,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/43772\/revisions"}],"predecessor-version":[{"id":158777,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/43772\/revisions\/158777"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media\/4973"}],"wp:attachment":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media?parent=43772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/categories?post=43772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/tags?post=43772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}