WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to old post: How to secure WordPress XMLRPC?, every API require authentication.

So, what is the point of adding X-Pingback in every public request?

curl -I http://ma.tt
X-Pingback: http://ma.tt/blog/xmlrpc.php
Content-Type: text/html; charset=UTF-8
share|improve this question
up vote 3 down vote accepted

I think that when talking about XMLRPC in the context of wordpress you usually mean to talk about authoring tools utilizing the XMLRPC protocol, and not about the protocol in general.

In case of pingbacks and trackbacks the XMLRPC protocol is utelized to send content (comment) to your site by some other entity which is probably doing it in some automattic way. That entity needs to know the endpoint to which to send it request based on the address of the page where the comment should be published, there for you need to be able to retrieve the address of the endpoint from the URL of the page and this is done by the page adding the address as an HTTP header (maybe it can also be done by adding a meta tag to the HTML).

TL;DR; the HTTP header is related to supporting pingbacks which works in different way then XMLRPC based publishing

Unfortunately even when pingback and trackbacks are disabled the HTTP header is being sent. If you want to disable it, add the following code to your theme functions.php (taken from here)

function remove_x_pingback($headers) {
    return $headers;
add_filter('wp_headers', 'remove_x_pingback');
share|improve this answer
It is possible to disable all of these xmlrpc stuffs directly? – Yoga Dec 14 '12 at 10:35
Answear updated – Mark Kaplun Dec 14 '12 at 10:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.