Myth-Busting SOP: 'Don't Disable XML-RPC, You'll Break Things'

Myth-Busting SOP: 'Don't Disable XML-RPC, You'll Break Things'

The fear: kill xmlrpc.php and Jetpack or the mobile app dies. Most modern setups use the REST API now, and XML-RPC enables pingback DDoS and amplified brute force. Decide methodically:

— Step 1: Audit what truly needs it — run logs through grep xmlrpc.php access.log for a week.
— Step 2: If nothing legitimate hits it, block it at nginx: location = /xmlrpc.php { deny all; }.
— Step 3: If Jetpack needs it, allowlist Jetpack's IP ranges only, deny the rest.
— Step 4: Disable the system.multicall method to stop credential amplification even if you keep the file.
— Step 5: Verify with curl -I https://site/xmlrpc.php — expect 403 for blocked hosts.

XML-RPC is opt-in, not load-bearing. Run this every time.