On our web servers, WordPress's xmlrpc.php is closed by default. This protects your website against one of the most commonly used break-in routes and keeps your site fast. Do you still need xmlrpc.php? Then you can open it in a few clicks, for your own IP addresses or (not recommended) for everyone. This article shows you how.

1. What is xmlrpc.php?

xmlrpc.php is an old interface in WordPress. External programs can use it to log in and publish posts, for example a blogging program on your computer. Pingbacks (notifications that another site links to yours) also go through this file.

Modern WordPress components hardly use xmlrpc.php anymore. The dashboard, the block editor and most plugins work through the REST API.

2. Why is xmlrpc.php closed by default?

xmlrpc.php is a favorite target for attackers:

  • Guessing passwords on a large scale. A single request to xmlrpc.php can try hundreds of passwords at once. A weak password is found quickly that way.
  • Your website gets slower. Every attempt starts WordPress. Thousands of attempts a day use computing power that your visitors need.
  • Abuse against others. Through pingbacks, your website can be used to attack other websites.

By closing xmlrpc.php by default, these attacks are stopped before they reach your website.

3. Does my website still work normally?

Yes. Your website, the WordPress dashboard, the login page and almost all plugins work as always. Specifically:

  • Jetpack and WordPress.com keep working. We always let them through.
  • The WordPress app works if your site is connected through Jetpack. If you can no longer log in to the app, open xmlrpc.php for your own IP address (see below).
  • Pingbacks from other websites no longer come in. For most sites that is actually a good thing, because pingbacks are mostly spam.
  • Do you use an external blogging program or an integration that needs xmlrpc.php? Then open it for the IP address of that program or service.

Do you see the message 403 Forbidden on xmlrpc.php? Then it is closed and the protection is working.

This is the easiest way. You do not need to edit any files.

  • Log in to DirectAdmin.
  • In the menu, go to Extra Features (in the Dutch interface: Extra Programma's) and click XML-RPC (WordPress).
  • Choose the domain at the top right.
  • Choose one of the three settings:
    • Closed (recommended, default).
    • Open for my IP addresses: enter one IP address per line. The Add button fills in your current IP address directly.
    • Open for everyone: not recommended, see section 7. You must first confirm that you understand the risks.
  • Click Save. The change takes effect within a minute.

The setting applies to the entire domain, including a WordPress installation in a subfolder.

5. Opening xmlrpc.php via .htaccess (manually)

Prefer to work in your files yourself? Then open the .htaccess file in the public_html folder of your domain via File Manager in DirectAdmin or via FTP, and put the rule at the top.

Opening it for one IP address

Replace 203.0.113.10 with your own IP address. Put a backslash before every dot:

SetEnvIf Remote_Addr "^203\.0\.113\.10$" !t7_xmlrpc_block

Multiple IP addresses? Then use one line per address. You write an IPv6 address as it is, for example:

SetEnvIf Remote_Addr "^2001:db8::10$" !t7_xmlrpc_block

SetEnvIf Remote_Addr "." !t7_xmlrpc_block

To close it again, simply remove the rule.

6. Note: do not use "Require ip" or "Require all granted

Online you often find examples like <Files xmlrpc.php> Require ip ... </Files>. Do not use them on our servers. On our servers, a rule like that opens xmlrpc.php to everyone, not just the IP address you specified. Require all granted also disables our extra protection against known attack bots.

So always use the rules from section 5, or the button in DirectAdmin.

7. Why we advise against "open for everyone

With xmlrpc.php open to everyone, attackers can keep trying passwords on your website day and night. That increases the chance of a break-in and makes your website slower. Does the service you use have a fixed IP address? Then open xmlrpc.php only for that address. Only choose "open for everyone" if there really is no other way, and in that case at least use:

  • a strong, unique password for every WordPress user;
  • two-step verification for administrators.

8. Need help?

Stuck, or has something stopped working since xmlrpc.php was closed? Contact our support team. Let us know which domain and which program or service it concerns. We will then set up xmlrpc.php correctly together with you.

Looking for WordPress hosting? View our plans.