Block xmlrpc.PHP — Bad Bots

If you run a WordPress website, you may not have heard of xmlrpc.php — but attackers certainly have. This file is a legacy part of WordPress that allows remote communication with your site. While it was useful in the early days of WordPress, it’s rarely needed today and is one of the most commonly exploited files on WordPress sites.

Attackers use it to run brute force login attempts, hijack your server for DDoS attacks, and probe your site for weaknesses. Blocking it takes just a few minutes and is one of the simplest security improvements you can make.

How To Block xmlrpc.php

Find your web server below and follow the steps for your setup.

Apache

Add the following to your .htaccess file, found in the root of your WordPress installation:

<Files "xmlrpc.php">
    Require all denied
</Files>

Simply add the follow these instructions to get started:

1. Log in to your hosting account and open your cPanel
2. Navigate to File Manager
3. Make sure you are in the root directory of your WordPress site — this is usually called public_html
4. Look for the .htaccess file in the file list. If you can’t see it, click Settings in the top right of File Manager and tick Show Hidden Files — the dot at the start of the filename means it is hidden by default
5. Right-click the .htaccess file and select Edit
6. Scroll to the bottom of the file and paste the code on a new line.

You can also use the FTP method or a plugin. It is better to not use a plugin when there are other viable options. The more plugins you have installed on your website, the greater the risk of conflicts, errors, site loading slow, or not loading at all.

Nginx

Add the following inside your server block in your Nginx config:

location = /xmlrpc.php {
    deny all;
}

To get started follow the Apache instructions.

Using A Plugin

It is advisable to not use a plugin when there are other viable options. The more plugins you have installed on your website, the greater the risk of conflicts, errors, site loading slow, or not loading at all.

Will blocking it break anything?

For the vast majority of WordPress sites, no. You only need xmlrpc.php if you use:

• Older versions of the WordPress mobile app
• Certain Jetpack features
• Third-party tools that connect to your site via XML-RPC

If you’re unsure, you can test your site after blocking it and simply remove the code if something stops working.