WordPress has always had built-in features that allow you to remotely interact with your site. Face it, there are times when you need to access your website and your computer isn’t around. For a long time, the solution was a file called xmlrpc.php. But in recent years, the archive has become more of a harm than a solution.
Below we will delve into what xmlrpc.php is and why it was created. We’ll also go over the common security issues it causes and how to fix them on your own site.
Take your WordPress site to the next level and get a secure WordPress web hosting solution with today.
What Is Xmlrpc.php?
XML-RPC is a WordPress feature that allows data to be transmitted, with HTTP acting as the transport mechanism and XML as the encoding mechanism. Since WordPress is not a self-contained system and occasionally needs to communicate with other systems, the intent was to do that job.
For example, let’s say you wanted to post to your site from your mobile device since your computer is not nearby. You could use the remote access feature enabled by xmlrpc.php to do this.
The main functions of xmlrpc.php were to allow you to connect to your site through a mobile phone, to implement trackbacks and pingbacks from other sites, and some functions associated with the Jetpack plugin.
Why was Xmlrpc.php created and what was it used for?
The implementation of XML-RPC dates back to the early days of WordPress even before it became WordPress itself.
In the early days of the Internet, when connections were incredibly slow, the process of writing and publishing on the web was much more difficult and time-consuming. Instead of typing inside the browser, most people would type offline, then copy and paste their content onto the web. Still, this process was far from ideal.
The solution (at the time) was to create an offline blogging client where you could write your content and then connect to your blog to publish it. This connection was made through XML-RPC. With the basic XML-RPC framework in place, early applications used this same connection to allow people to log into their WordPress sites from other devices.
XML-RPC today
Back in 2008 with WordPress version 2.6, there was an option to enable or disable XML-RPC. However, with the release of the WordPress iPhone app, XML-RPC support was enabled by default, and there was no option to disable this setting. And this has remained so to this day.
However, the functionality of this file has decreased considerably over time, and the overall size of the file has decreased from 83kb to 3kb, so it doesn’t play as much of a role as it used to.
The future of XML-RPC
With the new WordPress API, we can expect XML-RPC to be removed altogether. Today this new API is still in the testing phase and can only be enabled through the use of a plugin.
However, you can expect the API to be coded directly into WordPress core in the future, which would eliminate the need for the xmlrpc.php file altogether.
The new API is not perfect, but it does provide a more robust and secure solution to the problem that xmlrpc.php was trying to solve.
Why you should disable Xmlrpc.php
The biggest problems with XML-RPC are related to security. The issues are not directly with XML-RPC, but with how the file can be used to allow a brute force attack on your site.
Sure, you can protect yourself with incredibly strong passwords and plugins from . But, the best way of protection is to simply disable it.
There are two main weaknesses in XML-RPC that have been exploited in the past.
The first is to use brute force attacks to gain access to your site. An attacker will try to access your site using xmlrpc.php using various username and password combinations. They can even use a single command to try hundreds of different passwords. This allows them to bypass security tools that normally detect and block brute force attacks.
The second was to disable sites through a DDoS attack. Hackers used the pingback feature in WordPress to send pingbacks to thousands of sites instantly. This feature in xmlrpc.php gives hackers a nearly endless supply of IP addresses to deliver a DDoS attack.
To check if XML-RPC is active on your site, you can run it through a tool called . Run your site through the tool, and if you get an error message, it means you don’t have XML-RPC enabled.
If you get a success message, you can stop xmlrpc.php with one of the following two methods.
Method 1: Disable Xmlrpc.php with plugins
Disabling XML-RPC on your WordPress site couldn’t be easier.
Just go to the section Plugins > Add New from your WordPress dashboard. Search Disable XML-RPC and install the plugin that looks like the one in the image below:
Activate the plugin and you’re done. This plugin will automatically insert the necessary code to disable XML-RPC.
However, keep in mind that some existing plugins may use parts of XML-RPC, so disabling it entirely could cause a plugin conflict or cause certain elements of your site to stop working.
If you want to disable certain elements of XML-RPC, but still allow certain plugins and features to work, use the following plugins:
- . This plugin will stop all XML-RPC attacks, but will continue to allow plugins like Jetpack and other automated tools and plugins to maintain access to the xmlrpc.php file.
- . This allows you to retain control and use over the remote publish option provided by xmlrpc.php.
Method 2: Manually disable Xmlrpc.php
If you don’t want to use a plugin and prefer to do it manually, use this method. It will stop all incoming requests from xmlrpc.php before passing them on to WordPress.
open your . You may need to enable the “show hidden files” feature within the file manager or your FTP client to locate this file.
inside your file .htaccesspaste the following code:
# Block WordPress xmlrpc.php requests
Note: Change xxx.xxx.xxx.xxx to the IP address you want to allow access to xmlrpc.php or remove this line entirely.
final words
Overall, XML-RPC was a solid solution to some of the issues that were occurring due to remote publishing to your WordPress site. However, with this feature came some security loopholes that ended up being quite harmful for some WordPress site owners.
To ensure your site remains secure, it’s a good idea to disable xmlrpc.php entirely. Unless you need some of the features for remote publishing and the Jetpack plugin. In such a case, you should use plugins that enable these features, while also addressing security holes.
Over time, we can expect XML-RPC features to be integrated into the new WordPress API, which will maintain remote access and such, without sacrificing security. But in the meantime, it’s a good idea to guard against potential XML-RPC security holes.
Have you blocked XML-RPC access through a plugin or manually? Or did you have any security problems having it active? You can share your experience in the comments below.
Gustavo is passionate about creating websites. He focuses on the application of SEO strategies at for Spain and Latin America, as well as the creation of high-level content. When he is not applying new WordPress tricks you can find him playing the guitar, traveling or taking an online course.
Facebook Comments
Disqus