Deactivating the XMLRPC interface

API Interface 1
Contents

    Deactivating the XMLRPC interface

    If you want to improve the security of your WordPress site, the first step is to deactivate the xmlrpc interface.

    Why is that?

    This interface is from the early days of WordPress. At that time it was still called b2 and was exclusively a blogging service. The interface was responsible for all communication between the blog and external sources. This is no longer needed, as WordPress has replaced it with other secure interfaces. Nevertheless, it is still present and usually not activated. This poses a high security risk, as DDoS attacks or brute force attacks can be initiated.

    How can I deactivate the interface?

    This is relatively simple. All you have to do is write the following code in the .htaccess:

    
    
    Order Allow,Deny
    
    Deny from all
    
    
    
    
    
    

    This deactivates the xmlrpc interface and the page is secure.

    However, if you use pages with nginx servers or similar, you have to add the following filter solution to functions.php.

    add_filter( ‘xmlrpc_enabled’, ‘__return_false’ );

    Dieser Beitrag ist auch verfügbar auf: Deutsch (German)

    Updated on 29. March 2024
    Was this article helpful?

    Leave a Reply

    Your email address will not be published. Required fields are marked *