XML-RPC on Flywheel

XML-RPC stands for extensible markup language remote procedure calls, but for simplicity, we can think of it as the legacy WordPress API. It was a method to allow remote access to a WordPress site for apps and third-party services to manage a site. For example, the WordPress Mobile App, Zapier, or trackbacks and pingbacks.

In WordPress 4.4, they added a new REST API to WordPress core, essentially replacing the need for XML-RPC. However, they still keep XML-RPC around for backward compatibility with some services that might still be using it.

What is an XML-RPC attack?

The main attack on a WordPress site from XML-RPC comes in the form of a brute force or password guessing attack. Because the WordPress XML-RPC path is so well known, example.com/xmlrpc.php, malicious bots will try to detect that on a site, and attempt to guess a username and password for an admin user giving them access to the site.

These brute force attacks can slow down the site significantly from repeated attempts and can have a similar effect as a Denial of Service attack using up server resources, causing a site to go down.

Another non-attack issue that could come from allowing XML-RPC access is trackbacks and pingbacks. They are a way of alerting sites that a post has been linked to from another site. If a popular post was linked to many times, this could also cause Denial of Service to the site.

How does Flywheel protect my sites from XML-RPC attacks?

The number of sites that still need to use XML-RPC has dropped significantly over the last few years since WordPress introduced a REST API. Because of this, at Flywheel, we block XML-RPC access by default for all sites. With that being said, we do still allow access to some well-known services that are still using it.

Need help?

If you have any questions our Happiness Engineers are here to help!