CMS Security
xmlrpc.php Access Check
The xmlrpc.php file is an entry point for brute‑force and DDoS attacks. Learn how to disable it to enhance your WordPress site security.
What this test checks
This test checks whether xmlrpc.php is publicly accessible. This file enables communication between WordPress and other services (e.g., mobile apps, WordPress clients). It is known to be a target for brute‑force attacks (e.g., XML‑RPC brute force with the 'wp.getUsersBlogs' action) and denial‑of‑service (DDoS) attacks.
Our recommendation
Disable xmlrpc.php if you don't use it. To do so, add 'add_filter('xmlrpc_enabled', '__return_false');' in your theme (functions.php) or use a security plugin (e.g., Disable XML‑RPC Pingback). If you use xmlrpc.php, protect it with strong authentication and limit calls to authorised IP addresses.
Security tests
Read more
Sensitive Files