WP Functions

Disable XML-RPC

Stops brute-force attacks through xmlrpc.php.

Hook
xmlrpc_enabled
Updated
2026-09-27
License
GPLv2

Don’t use this if you rely on Jetpack or the WordPress mobile app.

add_filter( 'xmlrpc_enabled', '__return_false' );
Open in the builder

Licensed under GPL-2.0-or-later, provided as is. Review and test it before using it on a live site.

How it works

XML-RPC is an old API that lets apps talk to WordPress through xmlrpc.php. Bots love it: one request can try hundreds of passwords. Returning false from the xmlrpc_enabled filter turns off every XML-RPC method that needs a login, which is exactly what those attacks use.

Before you use it

  • Jetpack and the WordPress mobile apps can depend on XML-RPC. If you use them, test them after adding the code.
  • The REST API, the block editor and Application Passwords don’t use XML-RPC and keep working.
  • The file still answers requests, and public methods like pingbacks still reply. To block the file completely, deny access to xmlrpc.php in your server configuration.

How to check it works

Try to log in through an app or tool that uses XML-RPC. WordPress should answer that XML-RPC services are disabled on this site.

How to undo it

Remove the line. XML-RPC works again right away.

How to add this snippet

  1. Copy the code above.
  2. Paste it at the end of your child theme’s functions.php, in Appearance → Theme File Editor or over FTP.
  3. Save, then open the site and check that everything works. If something breaks, remove the code.

Need more than one? Open this snippet in the builder, turn on the others you want and copy them as one functions.php, or download them as a small plugin.

More in Security