FAQ SOP: Is it safe to disable XML-RPC?

FAQ SOP: Is it safe to disable XML-RPC?

Usually yes. Confirm dependencies first, then kill it.

— Step 1: Check usage. If you do not use the Jetpack app, the WordPress mobile app, or pingbacks, you do not need XML-RPC.
— Step 2: Block at the server, not via plugin: in nginx, location = /xmlrpc.php { deny all; }.
— Step 3: If you need Jetpack, do not block fully. Instead disable only pingback: filter out xmlrpc.pingback.ping.
— Step 4: Verify: curl -I https://yoursite.com/xmlrpc.php should return 403.
— Step 5: Watch logs for 24 hours for broken integrations.

XML-RPC enables credential brute-force amplification. Most sites lose nothing by blocking it.

Run this on every new site.