{"id":14801,"date":"2021-07-01T07:37:46","date_gmt":"2021-07-01T07:37:46","guid":{"rendered":"https:\/\/newblog.siteground.com\/en\/?p=14801"},"modified":"2025-03-31T07:28:01","modified_gmt":"2025-03-31T07:28:01","slug":"xmlrpc","status":"publish","type":"post","link":"https:\/\/academy.siteground.com\/en\/xmlrpc\/","title":{"rendered":"What is XMLRPC and How This WordPress&#8217; Vestigial Tail Threatens Your Website Security"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In the root directory of every WordPress site is a file, xmlrpc.php that actually predates WordPress itself. Back before WordPress, during the b2 days, this file was created to give sites a way to communicate with each other and for other applications to communicate with the blog itself.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"what-is-xmlrpc\"><\/span>What is XMLRPC?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The name tells you everything you need to know about the functionality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>XML<\/strong> &#8211; This was designed to accept payloads in XML. These days JSON is a much more common format but XMLRPC predates JSON by quite a bit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>RPC<\/strong> &#8211; RPC stands for Remote Procedure Call. It was a standard by which one system could ask another system to do something. These days we use APIs &#8211; REST or Graph API &#8211; to do the same thing but before those existed, RPC was one of the ways we accomplished this.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"how-does-xmlrpc-work\"><\/span>How does XMLRPC work?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To make XMLRPC.php do something you had to POST a message to it. If you are not familiar with how browsers work, this is basically like clicking the Submit button on a form. That usually initiates a POST request.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you make a POST request to yourdomain.tld\/xmlrpc.php and you hand it a properly formatted XML payload, you can do things like create a post on your site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One of the things that XMLRPC was used for a lot back in the day was \u201cpingbacks\u201d. Those comments you see on posts that show that someone else linked to it on their blog.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"potential-security-threats-from-wordpress-xmlrpc\"><\/span>Potential security threats from WordPress\u2019 XMLRPC<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For a long time, XMLRPC was a useful tool. Those days are fading into history now. These days all of the functionality that XMLRPC used to be used for is handled by the built-in <a href=\"https:\/\/www.siteground.com\/wordpress-rest-api-guide\" target=\"_blank\" rel=\"noopener\" aria-label=\" (opens in a new tab)\">REST API<\/a>. Even though it\u2019s not used anymore. It\u2019s still hanging around. Those who get nostalgic about such things see it and smile. Those that are worried about security see it and frown.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">XMLRPC poses a couple of distinct security risks for WordPress sites that can result in severe WordPress XMLRPC attacks.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first type of WordPress XMLRPC attack is a simple <a href=\"https:\/\/newblog.siteground.com\/en\/brute-force-attacks\/\" data-type=\"post\" data-id=\"14101\">Brute Force attack<\/a>. Since part of the XML payload that is passed to WordPress is the login and password of the user that wants to take the action, it is an easy way for attackers to try out user name and password combos until they find one that works. Many security conscious site owners will limit the number of login attempts a user can make before locking them out but won\u2019t bother to block XMLRPC requests thus leaving a back-door open for attackers to try and find a way in.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Brute Force Attacks via XMLRPC<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once an attacker finds credentials that work, they are free then to attempt to do damage to your site by injecting content into your site\u2019s database. Whether these are Posts, Pages, or just comments, the end result is the same. Content that you did not approve and most likely do not want is being served by your site.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the very least, this means spam comments or posts. At the worst though, it could be innocuous posts or comments that have malware injected.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">DDoS attacks using XMLRPC<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Because one of the ways that XMLRPC was used was for pingbacks, malicious users can use it to overwhelm your server by issuing a lot of expensive requests all at once.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A pingback writes a record to your database. Writing to your database is an expensive task, resource wise. While a single pingback won\u2019t hurt your site\u2019s performance, hundreds or even thousands of them at once can bring even the beefiest server to its knees.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is called a DDos or Distributed Denial of Service attack. Distributed because it\u2019s usually not a single machine making all the requests, usually it is a whole bunch of machines spread out all over the place.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"how-to-disable-xmlrpc-in-wordpress\"><\/span>How to disable XMLRPC in WordPress<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are a few ways you can disable XMLRPC. I highly recommend that you do it because honestly, you just don\u2019t need it.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Through your webserver\u2019s config file&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you are familiar with how to block requests via your webserver\u2019s config files &#8211; and you have access to your webserver\u2019s config files, this is a great way to block it. For Apache, you can add this code to the .htaccess file in the root directory of your site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&lt;Files xmlrpc.php&gt;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">order deny,allow<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">deny from all<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&lt;\/Files&gt;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That will stop it dead in its tracks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Through your theme\u2019s functions.php file<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not one who likes to much around in your web server\u2019s config files, you can add a single line of code to your theme\u2019s functions.php file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">add_filter( &#8216;xmlrpc_enabled&#8217;, &#8216;__return_false&#8217; );<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Make sure and get that exactly right, there are 2 underscores before the word return. Again, this will turn it off. This tells WordPress itself that you don\u2019t want to accept XMLRPC requests.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Installing a plugin<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, if don\u2019t want to bother with adding code to your theme\u2019s functions.php, you can disable XMLRPC in WordPress by installing a plugin. (Hint, the plug does the exact same thing as the previous tip.) There are several good ones out there that are free or you may already have this functionality available to you if you have one of the Application Firewall plugins installed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If not, let me recommend my favourite one and what I use on all of my sites to turn off XMLRPC, <a href=\"https:\/\/newblog.siteground.com\/en\/sg-security\/\" data-type=\"post\" data-id=\"14576\" target=\"_blank\" rel=\"noopener\">SiteGround Security Plugin<\/a>. Even if you aren\u2019t hosting with SiteGround, you can use this free plugin to manage several different security tasks. If you only want it to turn off XMLRPC, then disable all the other options. That\u2019s one of the things I love about this plugin, everything is optional.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">XMLRPC served us well in it\u2019s day, but it\u2019s day has come and gone. It\u2019s time to let it retire gracefully. Until the WordPress core developers decide it is time to remove it, you need to protect yourself and your site by disabling it.<\/p>\n\n\n<p>[subscribe_cta]<\/p>","protected":false},"excerpt":{"rendered":"<p>In the root directory of every WordPress site is a file, xmlrpc.php that actually predates WordPress itself. Back before WordPress, during the b2 days, this file was created to give sites a way to communicate with each other and for other applications to communicate with the blog itself. What is XMLRPC? The name tells you &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/academy.siteground.com\/en\/xmlrpc\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;What is XMLRPC and How This WordPress&#8217; Vestigial Tail Threatens Your Website Security&#8221;<\/span><\/a><\/p>\n","protected":false},"author":35,"featured_media":14803,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-14801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v25.9 (Yoast SEO v28.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>What is XMLRPC and How This WordPress&#039; Vestigial Tail Threatens Your Website Security<\/title>\n<meta name=\"description\" content=\"In the root directory of every WordPress site is a file: xmlrpc.php. Learn how it works, why it leads to security threats and how to easily disable it.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/academy.siteground.com\/en\/xmlrpc\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is XMLRPC and How This WordPress&#039; Vestigial Tail Threatens Your Website Security\" \/>\n<meta property=\"og:description\" content=\"In the root directory of every WordPress site is a file: xmlrpc.php. Learn how it works, why it leads to security threats and how to easily disable it.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/academy.siteground.com\/en\/xmlrpc\/\" \/>\n<meta property=\"og:site_name\" content=\"SiteGround\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/siteground\" \/>\n<meta property=\"article:published_time\" content=\"2021-07-01T07:37:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-31T07:28:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2021\/06\/blog-post-1200x600-1.jpg\" \/>\n<meta name=\"author\" content=\"Cal Evans\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"What is XMLRPC and How it Threatens Your Website Security\" \/>\n<meta name=\"twitter:description\" content=\"In the root directory of every WordPress site is a file: xmlrpc.php. Learn how it works, why it leads to security threats and how to easily disable it.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2021\/06\/blog-post-1200x600-1.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@siteground\" \/>\n<meta name=\"twitter:site\" content=\"@siteground\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Cal Evans\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/\"},\"author\":{\"name\":\"Cal Evans\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#\\\/schema\\\/person\\\/ac2ec9d82232836e1c87de042cfea852\"},\"headline\":\"What is XMLRPC and How This WordPress&#8217; Vestigial Tail Threatens Your Website Security\",\"datePublished\":\"2021-07-01T07:37:46+00:00\",\"dateModified\":\"2025-03-31T07:28:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/\"},\"wordCount\":1056,\"commentCount\":16,\"publisher\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2021\\\/06\\\/blog-post-1200x600-1-1.jpg\",\"articleSection\":[\"WordPress\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/\",\"url\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/\",\"name\":\"What is XMLRPC and How This WordPress' Vestigial Tail Threatens Your Website Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2021\\\/06\\\/blog-post-1200x600-1-1.jpg\",\"datePublished\":\"2021-07-01T07:37:46+00:00\",\"dateModified\":\"2025-03-31T07:28:01+00:00\",\"description\":\"In the root directory of every WordPress site is a file: xmlrpc.php. Learn how it works, why it leads to security threats and how to easily disable it.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/#primaryimage\",\"url\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2021\\\/06\\\/blog-post-1200x600-1-1.jpg\",\"contentUrl\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2021\\\/06\\\/blog-post-1200x600-1-1.jpg\",\"width\":1200,\"height\":600,\"caption\":\"XMLRPC.php\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/xmlrpc\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is XMLRPC and How This WordPress&#8217; Vestigial Tail Threatens Your Website Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/\",\"name\":\"SiteGround Academy\",\"description\":\"The SiteGround academy provides a wide variety of tips, tools, and resources related to WordPress, web performance, website optimization and site security.\",\"publisher\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#organization\",\"name\":\"SiteGround\",\"url\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2025\\\/01\\\/Siteground-Logo-on-white.jpg\",\"contentUrl\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2025\\\/01\\\/Siteground-Logo-on-white.jpg\",\"width\":1200,\"height\":400,\"caption\":\"SiteGround\"},\"image\":{\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/siteground\",\"https:\\\/\\\/x.com\\\/siteground\",\"https:\\\/\\\/www.instagram.com\\\/siteground\\\/\",\"https:\\\/\\\/www.youtube.com\\\/@siteground\"],\"description\":\"The SiteGround academy provides a wide variety of tips, tools, and resources related to WordPress, web performance, website optimization and site security.\",\"foundingDate\":\"2004-03-22\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"501\",\"maxValue\":\"1000\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/#\\\/schema\\\/person\\\/ac2ec9d82232836e1c87de042cfea852\",\"name\":\"Cal Evans\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6db3157414eef0b296f19e7ee76dffbe3280ba0e04d11c3a23c2db4523fd4948?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6db3157414eef0b296f19e7ee76dffbe3280ba0e04d11c3a23c2db4523fd4948?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6db3157414eef0b296f19e7ee76dffbe3280ba0e04d11c3a23c2db4523fd4948?s=96&d=mm&r=g\",\"caption\":\"Cal Evans\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/calevans\\\/\"],\"url\":\"https:\\\/\\\/academy.siteground.com\\\/en\\\/author\\\/calevans\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"What is XMLRPC and How This WordPress' Vestigial Tail Threatens Your Website Security","description":"In the root directory of every WordPress site is a file: xmlrpc.php. Learn how it works, why it leads to security threats and how to easily disable it.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/academy.siteground.com\/en\/xmlrpc\/","og_locale":"en_US","og_type":"article","og_title":"What is XMLRPC and How This WordPress' Vestigial Tail Threatens Your Website Security","og_description":"In the root directory of every WordPress site is a file: xmlrpc.php. Learn how it works, why it leads to security threats and how to easily disable it.","og_url":"https:\/\/academy.siteground.com\/en\/xmlrpc\/","og_site_name":"SiteGround","article_publisher":"https:\/\/www.facebook.com\/siteground","article_published_time":"2021-07-01T07:37:46+00:00","article_modified_time":"2025-03-31T07:28:01+00:00","og_image":[{"url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2021\/06\/blog-post-1200x600-1.jpg","type":"","width":"","height":""}],"author":"Cal Evans","twitter_card":"summary_large_image","twitter_title":"What is XMLRPC and How it Threatens Your Website Security","twitter_description":"In the root directory of every WordPress site is a file: xmlrpc.php. Learn how it works, why it leads to security threats and how to easily disable it.","twitter_image":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2021\/06\/blog-post-1200x600-1.jpg","twitter_creator":"@siteground","twitter_site":"@siteground","twitter_misc":{"Written by":"Cal Evans","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/#article","isPartOf":{"@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/"},"author":{"name":"Cal Evans","@id":"https:\/\/academy.siteground.com\/en\/#\/schema\/person\/ac2ec9d82232836e1c87de042cfea852"},"headline":"What is XMLRPC and How This WordPress&#8217; Vestigial Tail Threatens Your Website Security","datePublished":"2021-07-01T07:37:46+00:00","dateModified":"2025-03-31T07:28:01+00:00","mainEntityOfPage":{"@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/"},"wordCount":1056,"commentCount":16,"publisher":{"@id":"https:\/\/academy.siteground.com\/en\/#organization"},"image":{"@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/#primaryimage"},"thumbnailUrl":"https:\/\/academy.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2021\/06\/blog-post-1200x600-1-1.jpg","articleSection":["WordPress"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/academy.siteground.com\/en\/xmlrpc\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/","url":"https:\/\/academy.siteground.com\/en\/xmlrpc\/","name":"What is XMLRPC and How This WordPress' Vestigial Tail Threatens Your Website Security","isPartOf":{"@id":"https:\/\/academy.siteground.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/#primaryimage"},"image":{"@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/#primaryimage"},"thumbnailUrl":"https:\/\/academy.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2021\/06\/blog-post-1200x600-1-1.jpg","datePublished":"2021-07-01T07:37:46+00:00","dateModified":"2025-03-31T07:28:01+00:00","description":"In the root directory of every WordPress site is a file: xmlrpc.php. Learn how it works, why it leads to security threats and how to easily disable it.","breadcrumb":{"@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/academy.siteground.com\/en\/xmlrpc\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/#primaryimage","url":"https:\/\/academy.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2021\/06\/blog-post-1200x600-1-1.jpg","contentUrl":"https:\/\/academy.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2021\/06\/blog-post-1200x600-1-1.jpg","width":1200,"height":600,"caption":"XMLRPC.php"},{"@type":"BreadcrumbList","@id":"https:\/\/academy.siteground.com\/en\/xmlrpc\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/academy.siteground.com\/en\/"},{"@type":"ListItem","position":2,"name":"What is XMLRPC and How This WordPress&#8217; Vestigial Tail Threatens Your Website Security"}]},{"@type":"WebSite","@id":"https:\/\/academy.siteground.com\/en\/#website","url":"https:\/\/academy.siteground.com\/en\/","name":"SiteGround Academy","description":"The SiteGround academy provides a wide variety of tips, tools, and resources related to WordPress, web performance, website optimization and site security.","publisher":{"@id":"https:\/\/academy.siteground.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/academy.siteground.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/academy.siteground.com\/en\/#organization","name":"SiteGround","url":"https:\/\/academy.siteground.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/academy.siteground.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/academy.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg","contentUrl":"https:\/\/academy.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg","width":1200,"height":400,"caption":"SiteGround"},"image":{"@id":"https:\/\/academy.siteground.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/siteground","https:\/\/x.com\/siteground","https:\/\/www.instagram.com\/siteground\/","https:\/\/www.youtube.com\/@siteground"],"description":"The SiteGround academy provides a wide variety of tips, tools, and resources related to WordPress, web performance, website optimization and site security.","foundingDate":"2004-03-22","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"501","maxValue":"1000"}},{"@type":"Person","@id":"https:\/\/academy.siteground.com\/en\/#\/schema\/person\/ac2ec9d82232836e1c87de042cfea852","name":"Cal Evans","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6db3157414eef0b296f19e7ee76dffbe3280ba0e04d11c3a23c2db4523fd4948?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6db3157414eef0b296f19e7ee76dffbe3280ba0e04d11c3a23c2db4523fd4948?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6db3157414eef0b296f19e7ee76dffbe3280ba0e04d11c3a23c2db4523fd4948?s=96&d=mm&r=g","caption":"Cal Evans"},"sameAs":["https:\/\/www.linkedin.com\/in\/calevans\/"],"url":"https:\/\/academy.siteground.com\/en\/author\/calevans\/"}]}},"_links":{"self":[{"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/posts\/14801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/comments?post=14801"}],"version-history":[{"count":1,"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/posts\/14801\/revisions"}],"predecessor-version":[{"id":23508,"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/posts\/14801\/revisions\/23508"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/media\/14803"}],"wp:attachment":[{"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/media?parent=14801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/categories?post=14801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/academy.siteground.com\/en\/wp-json\/wp\/v2\/tags?post=14801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}