I have never used XMLRPC for any activity for my WordPress sites and also not going to do so.

There are many articles on disabling XMLRPC on your site for additional security. In the use case scenario that I discussed when if that service is not required, why to disbale it or make it more secure ? I just wish to simply delete the xmlrpc.php. Will it cause any errors if I delete it ?

  • 2
    Don't delete the file. It will just come back whenever WordPress updates. If you want to disable its functionality there are plenty of plugins that do that. Commented Nov 2, 2018 at 6:05
  • @JacobPeattie You are right about file coming back with update. I overlooked that possibility. Thanks. Commented Nov 2, 2018 at 6:17

2 Answers 2


You shouldn't delete that file - it will be restored after update - so deleting it makes no sense (and it shouldn't be treated as security fix).

You can disable XMLRPC using filter:

add_filter('xmlrpc_enabled', '__return_false');

And even block access to that file. Below code for Apache (sandrodz showed code for nginx):

<Files xmlrpc.php>
    Order deny,allow
    Deny from all

As mentioned in comments, if you delete the file, updating WP will bring it back.

It is best to block it at server level. In nginx I do following:

# Disable xmlrpc.php it is being abused by script kiddies
location ~ xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
    return 444;
  • Seems good blocking method too. I accepted @krzysiek as it has method for wordpress filter too if server specific method has some restrictions on that particular hosting. Thanks for your contribution. Commented Nov 13, 2018 at 11:51
  • @RajeshKakkad Sure, his answer is good. But be warned that blocking this on application level is not recommended. You'r server will still get hammered by bots requesting xmlrpc.php for no good reason.
    – sandrodz
    Commented Nov 13, 2018 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.