Because there are a lot of attacks lately on xmlrpc.php, I want to block access to this file or disable it.

I am aware some remote updating functions won't work (like the mobile app) but that doesn't matter in my case.

However, I want to be sure the updating services (like pinging Pingomatic) are not affected by this. Can anyone confirm me the pinging will be successful without xmlrpc.php being reachable? I don't want the automatic pinging after new posts to be affected with this change.

  • I'm wondering the same thing after learning that DigitalOcean's Wordpress image blocks xmlrpc. Based on the one relevant answer I'm guessing no, it doesn't affect the outgoing call to Pingomatic, but still not 100%. Mar 20, 2021 at 2:43

2 Answers 2


As far as I remember pings are outgoing, they don't need your site to accept incoming XML–RPC requests.

The call might not be even coming from your site at all. For example http://pingomatic.com/ site allows you to perform pings for arbitrary URLs.


The XML-RPC is a common way for hackers to exploit your website. It does more damage than good unless you implement strict security. To disable the XML-RPC, add the following into your functions.php:

add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'xmlrpc_methods', 'wpse_236551_xmlrpc_methods' );

function wpse_236551_xmlrpc_methods( $methods ) { // Disable XML-RPC methods
    unset( $methods['pingback.ping'] );
    return $methods;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.