How To Disable WordPress XMLRPC.php via (dot)htaccess Print

Enabling the xmlrpc.php file in WordPress can expose your site to malicious users who often target this file. This can lead to an influx of malicious traffic, quickly exhausting your resource limits. To enhance your site's security, you can disable XML-RPC by configuring your (dot)htaccess file.

Using cPanel's File Manager

To get started, log in to your cPanel account:

1. Scroll to the Files section and click on File Manager.
2. When the page loads, you will typically be in the public_html directory, which is the document root for your website.
3. Toggle Show Hidden Files to display all existing dot (.) files.

How to Find a (dot)htaccess File in Your cPanel

If there are no (dot)htaccess files present, you can create a new one:

1. In the File Manager, click on + File to create a new file and name it .htaccess.
2. If an existing (dot)htaccess the file is found, right-click on it and select Edit.

Once you have located or created the (dot)htaccess file, you can add the following code to disable XML-RPC:

    
# block malicious WordPress xmlrpc.php requests
# to allow XML-RPC from a particular IP:
# replace xxx.xxx.xxx.xxx with the IP address.

Require all denied
# Require ip xxx.xxx.xxx.xxx  

Important Note: The above rule is missing some critical blocks for optimal security. To block WordPress xmlrpc.php requests, download the full directive from download the full directive.

After pasting the code, make sure to save and close the file.

Using the Command-Line Interface (CLI)

If you prefer using a command-line interface, you can also disable XML-RPC like this:

vi public_html/.htaccess

Paste in the directive mentioned above and save your changes by typing:

:wq

To exit without saving, you can use:

:q!

Disabling XML-RPC in WordPress through the (dot)htaccess file is a straightforward way to enhance your site's security. By following these steps, you can safeguard your website from potential threats and ensure better resource management.