Sun, 26 Apr 2026 14:39:41 +0000
wordpress, security, webdev

WordPress ships with XML-RPC enabled. Most sites never need it.

Bots do. It accepts unauthenticated requests — brute-force login attempts that hammer your server even when they fail.

That's a security hole AND a performance drain you're paying for right now.

One line to disable it. Zero downside unless you use the official WordPress mobile app.