What Is XML-RPC in WordPress?
Definition
XML-RPC is an older remote-control interface built into WordPress at xmlrpc.php. It lets outside software, such as early mobile apps, desktop blogging tools, and some plugins, log in and publish or manage content. Because it accepts usernames and passwords, it is also a favorite target for password guessing and abuse.
How It Works
A program sends an XML-formatted request to xmlrpc.php naming a method, such as "get my categories" or "publish this post," along with a username and password. WordPress checks the credentials and runs the method.
Two features make it attractive to attackers:
- Every call carries a password. A failed call is a free password test that does not touch the normal login page, so some login protections never see it.
system.multicallbundles many method calls into one HTTP request. WordPress's brute force guidance warns thatxmlrpc.php"is a frequent brute-force target (especially the system.multicall method)."
Newer WordPress features use the REST API and application passwords instead, so many sites no longer need XML-RPC at all. WordPress's advice is simple: "If you don't use XML-RPC, disable it. If you do (e.g., Jetpack, mobile apps), restrict it (WAF rules) and rate-limit aggressively." Disabling it at the web server or WAF stops the requests before PHP runs, which saves server resources during an attack.
Real-World Example
In October 2015, Sucuri, a website security vendor, reported "brute force amplification" attacks against WordPress XML-RPC that it first spotted on September 10, 2015. In its words, attackers were "leveraging the system.multicall method to attempt to guess hundreds of passwords within just one HTTP request." Sucuri noted that "with only 3 or 4 HTTP requests, the attackers could try thousands of passwords," which let attackers sidestep tools that count login attempts per request. Most attempts used the wp.getCategories method. (Vendor research.)
Why It Matters for a Small Business
Most small business sites have XML-RPC switched on by default and never use it. That leaves an extra door that accepts passwords, often without the lockouts and two-factor checks that protect the normal login. An attacker who guesses an admin password through XML-RPC owns the site just as completely. Turning it off, or limiting it to the one service that needs it, is a small change that removes a whole class of attacks and reduces server load from bots.
How to Spot It / How DTS Handles It
Warning signs: many POST requests to xmlrpc.php in access logs, high CPU from PHP with no matching visitor traffic, failed login alerts that do not match wp-login.php activity, and plugins that still depend on XML-RPC without anyone knowing why.
DTS checks whether anything on the site uses XML-RPC. DTS can help with blocking it at the server or a WAF when nothing does, and restricting and rate limiting it when something does. See our WordPress maintenance service.
Related Terms
- Brute force attack: the main abuse of XML-RPC.
- Web application firewall (WAF): where XML-RPC is usually blocked or limited.
- Rate limiting: slowing repeated requests.
- REST API exposure: the newer interface that replaced most XML-RPC use.
- Credential stuffing: leaked passwords tested through any login endpoint.
- Rogue admin user: a common sign a guess succeeded.
Sources
- WordPress.org, Brute Force Attacks (Advanced Administration Handbook): https://developer.wordpress.org/advanced-administration/security/brute-force/
- Sucuri, Brute Force Amplification Attacks Against WordPress XMLRPC (October 2015, vendor research): https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html
Last updated October 14, 2026.