I've recently installed a couple of apps (WordPress and BlogPad Pro) and I'm a bit surprised to see that they can indeed post to my blogs, even though I haven't given them the renamed login and wp-admin pages that I set up through iThemes Security.

My understanding was that posting could only happen "through" the back end of the blog; i.e. if you couldn't log into the blog through the login page, you couldn't post to the blog either. But evidently, with my username and password, these apps can post to the blog.

How does the app know to get "around" the obscured login page to post to the blog?

  • 2
    Obscurity got almost nothing to do with real security. The "obsxurity" feature of ithemes security is no more then snake oil. – Mark Kaplun Dec 17 '14 at 14:24
  • Strong passwords are the main thing. If you got a weak password and you are trying to obscure the usual login path, to gain some "extra" security, then the bots can just work on your xml-prc access instead ;-) – birgire Dec 17 '14 at 14:51

Clients typically use XML-RPC Support.

If you take a look at your page source you will likely see endpoint declaration:

<link rel="EditURI" type="application/rsd+xml" title="RSD" href="http://example.com/xmlrpc.php?rsd" />
<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="http://example.com/wp-includes/wlwmanifest.xml" />

Apps are using this information and your credentials to access the site. In this way they can either discover location of admin or work without it altogether via XML-RPC.

| improve this answer | |
  • IIRC it is also reported as an http header – Mark Kaplun Dec 17 '14 at 14:27
  • Thanks -- I think I understand. So (a) does this pose a significant security risk (i.e. should I turn XML-RPC off), and if I do, (b) can these apps function at all without it? I'm enjoying the convenience of mobile blogging, but not at the cost of easy exploits. – JeanSibelius Dec 17 '14 at 14:32
  • @mattshepherd precisely no more or less than using WordPress admin. Obviously if client works over that protocol then turning it off will make it unable to. – Rarst Dec 17 '14 at 14:38

No, it's not required. WordPress support this kind of remote publishing through the XML-RPC interface of your blog:

             XML-RPC calls
      APP ------------------> Your Blog (example.com/xmlrpc.php)

The app isn't accessing your blog through the usual wp-login.php door, instead it's talking to your xmlprc.php file in the language of XML.

The the xmlrpc.php file is located in your WordPress root folder.

If you want to turn off the XML-RPC access, it's possible with this single line of code:

add_filter( 'xmlrpc_enabled', '__return_false' );

You can read more about this in the Codex.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.