If you run a small WordPress site on an Nginx server, you may have heard that you should disable XML-RPC in WordPress Nginx to keep your site safe. This guide will show you exactly how to do it in simple steps. You do not need to be a coding expert. We will cover three easy methods, how to check that it worked, and how to fix problems if they come up.
By the end of this guide, your WordPress site will be safer from common attacks that use XML-RPC. Let’s get started.
Quick Answer: How to Disable XML-RPC in WordPress on Nginx
The fastest way to disable XML-RPC in WordPress Nginx is to add a small block of code to your Nginx server config file. Open your Nginx config (usually at /etc/nginx/nginx.conf or inside /etc/nginx/sites-available/). Then add these lines inside your server block:
location = /xmlrpc.php { deny all; }Save the file. Test it with nginx -t. Then reload Nginx with sudo systemctl reload nginx. That’s it. The xmlrpc.php file is now blocked.
If you do not have server access, use a free plugin like “Disable XML-RPC” from the WordPress dashboard. We will cover both ways below.
Why You Should Disable XML-RPC in WordPress Nginx for Security
XML-RPC is an old feature in WordPress. It was built to let apps talk to your site. But today, most sites do not need it. And hackers love to use it to attack small websites. When you disable XML-RPC in WordPress Nginx, you close a door that bad actors often try to open.
What Is XML-RPC and Why Is It a Security Risk?
XML-RPC stands for “XML Remote Procedure Call.” Think of it as a phone line that lets other programs call your WordPress site. It was useful years ago when the WordPress mobile app needed it. But now, the WordPress REST API does most of that work.
The problem is that xmlrpc.php is open by default. Anyone on the web can reach it. Hackers use this to:
- Guess your login password over and over (brute force attacks)
- Make your server do work for them (DDoS reflection attacks)
- Scan your site for weak spots
When you disable XML-RPC in WordPress Nginx, these attacks stop cold.
Common XML-RPC Attacks Targeting Small Websites
Small websites are big targets. Here are the most common attacks that use XML-RPC:
| Attack Type | What It Does | Why It Matters |
|---|---|---|
| Brute Force Login | Tries thousands of passwords via system.multicall |
Can break into weak accounts fast |
| Pingback Spam | Fakes comments from other sites | Fills your site with junk |
| DDoS Amplification | Uses your site to attack others | Gets your server IP blacklisted |
| Port Scanning | Checks open ports on your network | Helps hackers plan bigger attacks |
Learning how to disable XML-RPC in WordPress Nginx blocks all four of these attacks at once.
Do You Actually Need XML-RPC? A Quick Decision Checklist
Before you disable XML-RPC in WordPress Nginx, check if you need it. Answer these questions:
- Do you use the old WordPress mobile app (not the new one)?
- Do you use Jetpack? (Some Jetpack features need XML-RPC)
- Do you publish from a third-party tool like IFTTT or Zapier?
- Do you run a multi-author site with remote posting?
If you answered “no” to all of these, you can safely disable XML-RPC in WordPress Nginx right now. If you said “yes” to one, you may want to keep it but limit access. We will show you how to do that too.
Method 1: Disable XML-RPC in WordPress Nginx via Server Configuration (Recommended)
This is the best way to disable XML-RPC in WordPress Nginx. It blocks the request before it even reaches WordPress. That means less work for your server and faster protection.
Step 1: Locate Your Nginx Configuration File
First, find your Nginx config file. The path depends on your setup:
- Main config:
/etc/nginx/nginx.conf - Site config (Ubuntu/Debian):
/etc/nginx/sites-available/your-site - Site config (CentOS/RHEL):
/etc/nginx/conf.d/your-site.conf - EasyEngine or WordOps:
/var/www/your-site/conf/nginx/
Use SSH to log into your server. Then run ls /etc/nginx/sites-available/ to see your site files. If you are not sure, ask your host where the Nginx config lives.
Step 2: Back Up Your Nginx Config Before Making Changes
Always make a backup before you disable XML-RPC in WordPress Nginx by editing server files. One wrong character can break your site.
Run this command to make a copy:
sudo cp /etc/nginx/sites-available/your-site /etc/nginx/sites-available/your-site.backupIf something goes wrong, you can restore with sudo cp your-site.backup your-site.
Step 3: Add the XML-RPC Block Code to Your Nginx Server Block
Open your config file with a text editor like nano or vim:
sudo nano /etc/nginx/sites-available/your-siteFind the server { } block. Add this code inside it, before the main location block:
# Block XML-RPC to improve security location = /xmlrpc.php { deny all; access_log off; log_not_found off; }This tells Nginx to reject any request for xmlrpc.php. The access_log off line keeps your logs clean.
Step 4: Test the Nginx Configuration with nginx -t
Before you reload, test your config. Run:
sudo nginx -tIf you see syntax is ok and test is successful, you are good to go. If you see an error, read it carefully. It will tell you the line number with the problem.
Step 5: Reload Nginx and Verify the Changes
Now reload Nginx to apply the change:
sudo systemctl reload nginxOpen your browser and go to https://yoursite.com/xmlrpc.php. You should see a 403 Forbidden error. That means you have successfully disabled XML-RPC in WordPress Nginx.
Understanding deny all vs return 403 vs return 444
When you disable XML-RPC in WordPress Nginx, you can choose how to block it:
| Code | What It Does | Best For |
|---|---|---|
deny all; |
Returns 403 Forbidden | Most cases, clear error |
return 403; |
Same as deny all | Short form, same result |
return 444; |
Closes connection with no response | Hide that the file exists |
Use return 444; if you want to be stealthy. Hackers will think the file does not exist.
Method 2: Disable XML-RPC in WordPress Nginx Using a Plugin (No Server Access Required)
If you cannot edit server files, you can still disable XML-RPC in WordPress Nginx with a plugin. This is the easiest way for beginners.
Best Plugins to Disable XML-RPC in WordPress
Here are the top free plugins to disable XML-RPC in WordPress Nginx:
- Disable XML-RPC — Simple, one-click, does just this job
- XML-RPC disable — Lightweight, no settings needed
- Wordfence Security — Full security suite with XML-RPC option
- Solid Security (iThemes) — Many hardening tools in one
How to Configure the Plugin to Block xmlrpc.php
To disable XML-RPC in WordPress Nginx with a plugin:
- Log into your WordPress dashboard.
- Go to Plugins → Add New.
- Search for “Disable XML-RPC”.
- Click Install Now, then Activate.
- Most plugins work right away. Some have a settings page under Settings.
That’s it. The plugin adds a filter that turns off XML-RPC at the WordPress level.
Pros and Cons of Plugin-Based XML-RPC Blocking
| Pros | Cons |
|---|---|
| No server access needed | Request still reaches WordPress |
| Easy to turn on and off | Uses a small amount of PHP memory |
| Works on shared hosting | Slower than Nginx-level blocking |
| No risk of breaking server config | Depends on plugin updates |
For most small sites, the plugin method is fine. But if you want the best speed and security, use Method 1.
Method 3: Disable XML-RPC via wp-config.php (Alternative Approach)
You can also disable XML-RPC in WordPress Nginx by adding a filter to your wp-config.php file. This is a middle ground between the Nginx method and the plugin method.
Open wp-config.php in your site root. Add this line before the “That’s all, stop editing!” comment:
add_filter('xmlrpc_enabled', '__return_false');Save the file. XML-RPC is now turned off at the WordPress level. This method works on any server type, not just Nginx.
How to Verify XML-RPC Is Successfully Disabled in WordPress Nginx
After you disable XML-RPC in WordPress Nginx, you must check that it worked. Here are three ways to test.
Testing with a Browser and cURL Commands
Open your browser and visit https://yoursite.com/xmlrpc.php. You should see:
- A 403 Forbidden page (Nginx method)
- A “XML-RPC services are disabled on this site.” message (plugin method)
You can also use cURL from your terminal:
curl -I https://yoursite.com/xmlrpc.phpLook for HTTP/2 403 in the output. That means the block is working.
Checking Nginx Access Logs for Blocked Requests
Watch your Nginx logs to see if attackers are still trying to reach xmlrpc.php:
sudo tail -f /var/log/nginx/access.log | grep xmlrpcYou will see 403 responses. This shows that your rule to disable XML-RPC in WordPress Nginx is catching real attacks.
Using Online XML-RPC Vulnerability Scanners
Free online tools can check if XML-RPC is open on your site:
- SecurityHeaders.com — Checks many security headers
- HackerTarget XML-RPC Scanner — Tests for open XML-RPC
- WPScans.com — Full WordPress security check
Enter your site URL. The tool will tell you if xmlrpc.php is still reachable. If it says “blocked” or “not found,” you have done a good job.
Troubleshooting Common Issues When Disabling XML-RPC in WordPress Nginx
Sometimes things do not go as planned. Here are the most common problems when you disable XML-RPC in WordPress Nginx and how to fix them.
XML-RPC Still Accessible After Adding the Nginx Block
If xmlrpc.php still works, check these:
- Did you reload Nginx? Run
sudo systemctl reload nginx. - Is the code inside the right
server { }block? If you have many, it must be in the one for your site. - Is there a caching layer (Cloudflare, Varnish) in front? Clear the cache.
- Did you put the block after a catch-all
location /rule? Move it above that rule.
Jetpack or WordPress Mobile App Stopped Working
Some features of Jetpack need XML-RPC. If you disable XML-RPC in WordPress Nginx and Jetpack breaks, you have two choices:
- Allow XML-RPC only from Jetpack IP addresses
- Turn off the Jetpack features that need it
To allow only Jetpack, change your Nginx block to:
location = /xmlrpc.php { allow 122.248.245.244; allow 54.217.201.243; allow 54.232.116.4; allow 192.0.80.0/20; deny all; }This keeps XML-RPC open for Jetpack but closed for everyone else.
Nginx Configuration Test Failed (nginx -t Error)
If nginx -t shows an error, read the message. Common mistakes:
- Missing semicolon at the end of a line
- Misspelled word like
locatoninstead oflocation - Wrong brace placement — every
{needs a}
Fix the error, then run nginx -t again. Do not reload until the test passes.
How to Roll Back Changes If Something Breaks
If your site goes down after you disable XML-RPC in WordPress Nginx, restore your backup:
sudo cp /etc/nginx/sites-available/your-site.backup /etc/nginx/sites-available/your-site sudo nginx -t sudo systemctl reload nginxYour site will be back to normal. Then check the config for the mistake and try again.
Disable XML-RPC in WordPress Nginx on Managed and Shared Hosting
Not everyone has root access to their server. If you are on managed WordPress hosting or shared hosting, you can still disable XML-RPC in WordPress Nginx.
What to Do If You Don’t Have Direct Nginx Access
Use the plugin method (Method 2) or the wp-config.php method (Method 3). Both work without server access. Many managed hosts like Kinsta, WP Engine, and SiteGround already block XML-RPC by default. Check with your host first.
Requesting XML-RPC Blocking from Your Hosting Provider
Open a support ticket with your host. Say:
“Please block access to /xmlrpc.php at the server level for my site. Return a 403 or 444 status. This is for security.”
Most hosts will do this for free within 24 hours. This is the cleanest way to disable XML-RPC in WordPress Nginx when you lack root access.
FAQ: Common Questions About Disabling XML-RPC in WordPress Nginx
Q: Will disabling XML-RPC break my site?
A: No. Most sites do not use XML-RPC at all. Your posts, pages, and plugins will keep working.
Q: Do I need to disable XML-RPC if I use Cloudflare?
A: Cloudflare can block some XML-RPC attacks, but it is still safer to disable XML-RPC in WordPress Nginx at the server level.
Q: Can I block XML-RPC for everyone except my IP?
A: Yes. Use the allow and deny rules shown in the Jetpack section above.
Q: Does this work on Apache servers too?
A: This guide is for Nginx. For Apache, you would use an .htaccess rule instead.
Q: How often should I check if XML-RPC is blocked?
A: Check once after you set it up. Then check again after any major server or WordPress update.
Final Checklist: Securing Your WordPress Site by Disabling XML-RPC in Nginx
Use this checklist to make sure you have fully disabled XML-RPC in WordPress Nginx:
- ☐ Backed up your Nginx config file
- ☐ Added the
location = /xmlrpc.php { deny all; }block - ☐ Ran
nginx -tand saw “syntax is ok” - ☐ Reloaded Nginx with
systemctl reload nginx - ☐ Tested
xmlrpc.phpin browser and got 403 - ☐ Checked Nginx logs for blocked requests
- ☐ Made sure Jetpack or mobile apps still work (if used)
- ☐ Saved a note of the change for your records
You have now taken a big step to keep your small website safe. Disabling XML-RPC in WordPress Nginx is one of the easiest wins in WordPress security. It takes five minutes and blocks many common attacks.
Next, think about other small security steps: keep WordPress updated, use strong passwords, add two-factor login, and take regular backups. Together, these steps make your site very hard to break into.
Good luck, and stay safe online!