How to Disable XML-RPC in WordPress Without Breaking Anything

XML-RPC is an old remote-access door into WordPress, a single file called xmlrpc.php in your site root. It has been switched on by default for years, and most sites have never used it. Security guides tell you to turn it off. What they usually skip is the part that matters: what stops working when you do.

I built SlimPress because I kept turning off the same parts of WordPress core on shop sites and wanted each switch to say what it might break. XML-RPC is one of the first ones people ask about, so here is the full picture.

What XML-RPC is used for

Before XML-RPC existed as a thing to worry about, it was how outside software talked to WordPress. Today three things still use it:

• The WordPress mobile app, on some setups, to publish and manage posts.
• Jetpack, which uses it to connect your site to WordPress.com.
• Pingbacks and trackbacks, the notifications between blogs that link to each other.

Some older desktop publishing tools and a few third-party services also use it. If none of the above applies to you, nothing on your site is likely to miss it.

Why people turn it off

Two reasons come up repeatedly. First, XML-RPC accepts login attempts, and it can bundle many of them into one request, which makes it a convenient target for password guessing. Second, pingbacks can be abused to make your site send requests to other places. Neither is a reason to panic, but if you are not using the feature, there is nothing to gain from leaving it exposed.

Step 1: check whether anything uses it

1. Open Plugins and look for Jetpack or any plugin that mentions WordPress.com, remote publishing or a mobile app.
2. Ask yourself whether anyone posts to the site from the WordPress mobile app or an old desktop editor.
3. Check Settings → Discussion. If "Allow link notifications from other blogs (pingbacks and trackbacks)" is ticked and you care about those, keep that in mind.

If the answer to all three is no, you can switch it off.

Step 2: switch it off

You can do this with a code snippet or a .htaccess rule, but then it is hard to remember later that you did it, and harder to undo. With SlimPress it is one switch:

1. Install and activate SlimPress. Activation changes nothing on its own.
2. Go to Settings → SlimPress and open the APIs & connections group.
3. Turn on Disable XML-RPC. It is marked Careful, and the note under it lists what might break: the WordPress mobile app, Jetpack and pingbacks.

SlimPress also warns you if an active plugin is known to rely on the feature you are about to switch off, so Jetpack on the same site would show up before you save.

Step 3: confirm it worked

Visit yoursite.com/xmlrpc.php. On a default WordPress site you will see the message "XML-RPC server accepts POST requests only." After the switch is on, that page should no longer behave like a working XML-RPC endpoint. Then open your site's front end and the dashboard to make sure nothing looks different. For most sites, nothing will.

If something stops working

This is the part I care about most. SlimPress keeps the last 10 versions of its settings, so any save can be undone, and every switch is a runtime filter. Deactivating the plugin puts WordPress back to its default behaviour on the next request. There is nothing in your database to clean up.

If Jetpack complains after the change, turn the switch off again and reconnect it. If you want to keep Jetpack and still reduce exposure, the better route is to leave XML-RPC on and add rate limiting at your firewall or host.

The short version

• Check for Jetpack, the mobile app and pingbacks first.
• If you use none of them, turn XML-RPC off.
• Check /xmlrpc.php afterwards, and know how to undo it.

SlimPress is free, with no pro tier and no telemetry. Support happens in the WordPress.org forums, in public.