I am fairly new to Wordpress and I recently noted a huge amount of traffic hitting the following: - - [01/Aug/2014:08:18:54 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 - - [01/Aug/2014:08:19:01 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 - - [01/Aug/2014:08:19:01 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 - - [01/Aug/2014:08:19:02 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 - - [01/Aug/2014:08:19:11 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861 - - [01/Aug/2014:08:19:13 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861 - - [01/Aug/2014:08:19:18 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861

I blocked the IP address which is a temp solution. Is there a permanent solution to blocking these requests, expecially if I don't need


There are plugins for that: e.g. http://wordpress.org/plugins/disable-xml-rpc/

You can also write a filter yourself

add_filter('xmlrpc_enabled', '__return_false');

You can simply add this code your theme functions.php (located in wp-content/themes/your_theme).

However, you are advised to create a child theme (http://codex.wordpress.org/Theme_Development) so that your modification does not disappear when you update the theme.

Alternatively, you can create your plugin (http://codex.wordpress.org/Writing_a_Plugin) where you will put all your WordPress tweaking.

I also add the following for a better protection:

 * Secure WordPress by removing version
remove_action('wp_head', 'wp_generator');

 * Secure WordPress by hiding login errors
function hide_login_errors($errors) { return 'login error'; }
add_filter('login_errors', 'hide_login_errors', 10, 1);
  • 2
    Will be nice if you add an explanation where to put the code and the implications of using this method – Mark Kaplun Aug 1 '14 at 14:15
  • Absolutely :) I edited the answer – YaFred Aug 1 '14 at 17:36
  • 2
    Please do not use create_function(). Ever. It is hard to read, and it cannot be stored in an opcache. – fuxia Aug 1 '14 at 17:56
  • what would you suggest ? – YaFred Aug 1 '14 at 18:09
  • Either a separate function or a closure. – fuxia Aug 3 '14 at 1:06

If your server is an Apache, you can block access before WordPress is even reached with one line in your .htaccess:

Redirect 403 /xmlrpc.php

You can add another line to keep the response short:

ErrorDocument 403 "no"

That will send a very minimal response (two bytes plus HTTP headers), and it will save your resources for better traffic.


An other way is to put this in your .htaccess file:

<Files "xmlrpc.php">
order allow,deny
deny from all
errordocument 403 /noaccess.html
errordocument 404 /noaccess.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.