xmlrpc.php: the WordPress endpoint you can almost certainly turn off

Vigil flagged this because /xmlrpc.php answered with the tell-tale “XML-RPC server accepts POST requests only” response — the endpoint is enabled and reachable. This is a warning, not an outage: it’s attack surface you probably don’t need, rather than something actively broken.

Why it matters

Two abuses make xmlrpc.php worth closing. The first is brute-force amplification: the system.multicall method lets an attacker bundle hundreds of wp.getUsersBlogs login attempts into a single HTTP request, so a rate limit that counts requests barely slows them down. The second is pingback reflection: the pingback.ping method can be coerced into making your server hammer a third-party target, turning your site into one node of a DDoS. Neither requires a vulnerability — just the endpoint being on.

If nothing you run calls xmlrpc.php, every request that reaches it is either a mistake or an attack.— the RD-10 design note

How to fix it

First check whether anything needs it. The classic consumers are the old WordPress mobile app, Jetpack, and some remote-publishing tools. Modern setups use the REST API instead. If nothing depends on it, block it at the web server — the cleanest, cheapest fix:

# nginx
location = /xmlrpc.php { deny all; return 403; }

# Apache / .htaccess
<Files xmlrpc.php>
  Require all denied
</Files>

// If you can only touch PHP: disable it and, at minimum, kill pingbacks
add_filter('xmlrpc_enabled', '__return_false');
add_filter('xmlrpc_methods', function ($methods) {
  unset($methods['pingback.ping'], $methods['pingback.extensions.getPingbacks']);
  return $methods;
});

Prefer the server-level block if you can — the xmlrpc_enabled filter stops the API methods but the endpoint still executes PHP. If you do need XML-RPC (e.g. Jetpack), leave it on but restrict it to known source IPs and keep pingbacks disabled. Re-run the probe once blocked: xmlrpc.php should return 403.

Our team can apply this fix on your site and verify it with Vigil. Already monitoring this site with Vigil? Open the failing check and hit “Request a fix” — we’ll get the exact problem and URL. Otherwise, get in touch.