WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be publishing through XMLRPC. WP is currently running on Lighttpd and php5.3.

share|improve this question
Which issue do you know about? And which one do you want to fix? – toscho Feb 1 '12 at 8:30
up vote 4 down vote accepted

XMLRPC is as secure as the rest of WordPress. All of the requests need to be authenticated with username and password credentials that exist on your site already. That means, if someone has a login for your site, they can use the XMLRPC interface (if it's turned on). But anonymous users can't get in.

The only potential security vulnerability you might face with XMLRPC is that of a man in the middle attack. But you face this same risk with the regular WordPress admin, so it's not unique to XMLRPC.

The best way to prevent this kind of an issue is to enable SSL security on your site. You'll need an SSL certificate, and then you need to access you XMLRPC endpoint via https:// rather than http://. This will encrypt your requests and prevent anyone from intercepting them and stealing your credentials.

You should also enable SSL security on login for your regular site because it, too, faces the same risks.

share|improve this answer
Also I would like to add that another security measure you can take is putting in code to stop brute forcing of your passwords. This is the same from XMLRPC and the normal logins. Many plugins out there can put in anti brute force measures in place. Login Lock and Login LockDown are just a couple. – Brady Feb 1 '12 at 17:04

The plugin Secure XML-RPC seems to address the issue of sending sensitive info over the wire.

Plugin description:

Rather than sending usernames and passwords in plain text with every request, we're going to use a set of public/secret keys to hash data and authenticate instead.

share|improve this answer

I suggest the following code to append to the .htaccess file

<FilesMatch "^(xmlrpc\.php)">
Order Deny,Allow
# IP address Whitelist
Allow from xxx.xxx.xxx.xxx
Deny from all
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.