WordPress Security
XML-RPC: The WordPress Feature Most Sites Don't Use and Attackers Love
An old remote-access feature, enabled by default, that lets attackers try hundreds of passwords in a single request. Here is what XML-RPC in WordPress does, and whether you can safely turn it off.
19 Jul 2026
5 min
Read