I have never used XMLRPC for any activity for my WordPress sites and also not going to do so.

There are many articles on disabling XMLRPC on your site for additional security. In the use case scenario that I discussed when if that service is not required, why to disbale it or make it more secure ? I just wish to simply delete the xmlrpc.php. Will it cause any errors if I delete it ?

  • 2
    Don't delete the file. It will just come back whenever WordPress updates. If you want to disable its functionality there are plenty of plugins that do that. Nov 2 '18 at 6:05
  • @JacobPeattie You are right about file coming back with update. I overlooked that possibility. Thanks. Nov 2 '18 at 6:17

You shouldn't delete that file - it will be restored after update - so deleting it makes no sense (and it shouldn't be treated as security fix).

You can disable XMLRPC using filter:

add_filter('xmlrpc_enabled', '__return_false');

And even block access to that file. Below code for Apache (sandrodz showed code for nginx):

<Files xmlrpc.php>
    Order deny,allow
    Deny from all

As mentioned in comments, if you delete the file, updating WP will bring it back.

It is best to block it at server level. In nginx I do following:

# Disable xmlrpc.php it is being abused by script kiddies
location ~ xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
    return 444;
  • Seems good blocking method too. I accepted @krzysiek as it has method for wordpress filter too if server specific method has some restrictions on that particular hosting. Thanks for your contribution. Nov 13 '18 at 11:51
  • @RajeshKakkad Sure, his answer is good. But be warned that blocking this on application level is not recommended. You'r server will still get hammered by bots requesting xmlrpc.php for no good reason.
    – sandrodz
    Nov 13 '18 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.