WordPress Security & Technical SEO

How to Safely Disable XML-RPC in WordPress Without Breaking Jetpack

XML-RPC is a common brute-force target. Disable it carefully so you do not break Jetpack, the WordPress mobile app, or remote publishing workflows.

Why XML-RPC gets attacked

Attackers hammer xmlrpc.php with multicall password guesses. Even failed attempts burn CPU and inflate TTFB under load.

Option 1: Server block with .htaccess

If you do not use Jetpack or remote publishing, block the file at Apache before PHP runs. Generate the rule with our free builder:

Open .htaccess Rule Generator

Option 2: Selective PHP filter

When Jetpack is required, prefer a plugin that disables pingbacks and multicall abuse while allowing authenticated Jetpack methods — or hire us to ship a lean custom hardening plugin.

FAQ

Does disabling XML-RPC break Jetpack?

A blanket block can. Use selective filters or allowlists when Jetpack is required.

Is .htaccess enough?

For sites that do not need XML-RPC, yes — it stops traffic before PHP boots.