3

Because there are a lot of attacks lately on xmlrpc.php, I want to block access to this file or disable it.

I am aware some remote updating functions won't work (like the mobile app) but that doesn't matter in my case.

However, I want to be sure the updating services (like pinging Pingomatic) are not affected by this. Can anyone confirm me the pinging will be successful without xmlrpc.php being reachable? I don't want the automatic pinging after new posts to be affected with this change.

1

As far as I remember pings are outgoing, they don't need your site to accept incoming XML–RPC requests.

The call might not be even coming from your site at all. For example http://pingomatic.com/ site allows you to perform pings for arbitrary URLs.

0

The XML-RPC is a common way for hackers to exploit your website. It does more damage than good unless you implement strict security. To disable the XML-RPC, add the following into your functions.php:

add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'xmlrpc_methods', 'wpse_236551_xmlrpc_methods' );

function wpse_236551_xmlrpc_methods( $methods ) { // Disable XML-RPC methods
    unset( $methods['pingback.ping'] );
    return $methods;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.