XML-RPC Settings for WordPress

XML-RPC Settings Configure XML-RPC methods to increase the security of your website:

Build-in features could be used for malicious purposes and cannot be disabled by default.

Disable GET access

XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.

Disable system.multicall

system.multicall method can be misused for amplification attacks.

Disable system.listMethods

system.listMethods method can be used for verifying attack scope.

Prevent malicious actors from enumerating usernames and credentials.

Disable authenticated methods

Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.

Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.

Disable pingbacks

Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.

Remove X-Pingback header

If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.