I am fairly new to Wordpress and I recently noted a huge amount of traffic hitting the following: - - [01/Aug/2014:08:18:54 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 - - [01/Aug/2014:08:19:01 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 - - [01/Aug/2014:08:19:01 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 - - [01/Aug/2014:08:19:02 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 - - [01/Aug/2014:08:19:11 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861 - - [01/Aug/2014:08:19:13 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861 - - [01/Aug/2014:08:19:18 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861

I blocked the IP address which is a temp solution. Is there a permanent solution to blocking these requests, expecially if I don't need

4 Answers 4


There are plugins for that: e.g. http://wordpress.org/plugins/disable-xml-rpc/

You can also write a filter yourself

add_filter('xmlrpc_enabled', '__return_false');

You can simply add this code your theme functions.php (located in wp-content/themes/your_theme).

However, you are advised to create a child theme (http://codex.wordpress.org/Theme_Development) so that your modification does not disappear when you update the theme.

Alternatively, you can create your plugin (http://codex.wordpress.org/Writing_a_Plugin) where you will put all your WordPress tweaking.

I also add the following for a better protection:

 * Secure WordPress by removing version
remove_action('wp_head', 'wp_generator');

 * Secure WordPress by hiding login errors
function hide_login_errors($errors) { return 'login error'; }
add_filter('login_errors', 'hide_login_errors', 10, 1);
  • 2
    Will be nice if you add an explanation where to put the code and the implications of using this method Aug 1, 2014 at 14:15
  • Absolutely :) I edited the answer
    – YaFred
    Aug 1, 2014 at 17:36
  • 2
    Please do not use create_function(). Ever. It is hard to read, and it cannot be stored in an opcache.
    – fuxia
    Aug 1, 2014 at 17:56
  • what would you suggest ?
    – YaFred
    Aug 1, 2014 at 18:09
  • Either a separate function or a closure.
    – fuxia
    Aug 3, 2014 at 1:06

If your server is an Apache, you can block access before WordPress is even reached with one line in your .htaccess:

Redirect 403 /xmlrpc.php

You can add another line to keep the response short:

ErrorDocument 403 "no"

That will send a very minimal response (two bytes plus HTTP headers), and it will save your resources for better traffic.


An other way is to put this in your .htaccess file:

<Files "xmlrpc.php">
order allow,deny
deny from all
errordocument 403 /noaccess.html
errordocument 404 /noaccess.html

or for nginx

# Disable xmlrpc.php it is being abused by script kiddies
location ~ xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
    return 444;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.