Disabling XML-RPC

[Rachel S]

Is disabling XML-RPC still important?

[wisly.k]

I still disable XML-RPC on most of my sites. It’s one of the most targeted endpoints for brute-force attacks, especially on smaller WordPress sites that don’t need remote publishing or mobile app access.

[Annie_P]

Agree. If you’re not using the WordPress mobile app or Jetpack, there’s really no benefit to keeping it enabled. Blocking xmlrpc.php reduces attack noise significantly.

[Paul Schmidt]

I wouldn’t say “disable it everywhere.” Some features still depend on XML-RPC. For example, Jetpack, WordPress.com integrations, and some third-party publishing tools break if it’s fully disabled.