How to allow WordPress XMLRPC access only from the local network or your domain

This section explains how to allow WordPress XMLRPC access only from the local network or your own domain.

What is XML-RPC?

XML-RPC (XML Remote Procedure Call) is a mechanism that allows you to post, edit, delete articles, upload media, and manage comments from outside without logging in to the WordPress administration screen by exchanging XML format data via HTTP. It exists as a file xmlrpc.php in the root directory of WordPress.

It has been enabled by default since WordPress 3.5 (2012), but REST API is now the mainstream, and XML-RPC remains for backward compatibility.
XMLRPC can be used as a springboard for brute force attacks (password brute force) or DDoS attacks (pinback exploits).

Configure .htaccess to restrict access except from the local network or your own domain.

Add the following settings to .htaccess in the same hierarchy as xmlrpc.php.

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
  Allow from 127.0.0.1
  Allow from ::1
  Allow from 123.123.123.123
</Files>

127.0.0.1 and ::1 mean localhost.
123.The 123.123.123.123 part should be the IP of your company’s local network.

Harmful Effects of Restrictions

Setting IP restrictions may affect some services and applications. Please check in advance.

Official WordPress apps (iOS / Android)

Official WordPress smartphone apps use XML-RPC to post and edit articles. Restrictions will prevent you from operating from the app.

Cooperation with external services

Jetpack has features that rely on XML-RPC, and some of them may stop working after the restriction; automatic posting to WordPress using IFTTT or Zapier may also stop.

External Blog Editors

Editors for posting articles from the desktop, such as MarsEdit (Mac) and Windows Live Writer, use XML-RPC and will not be available.

*But if the IP of your PC is fixed, you can use them by setting that IP to HTACCESS as permitted.

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
  Allow from 127.0.0.1
  Allow from ::1
  Allow from your ip here
</Files>>

Pinback/Trackback

You will not receive pingback notifications from other sites.

Free] WordPress:Malware Scan & Security Plugin [Malware and Virus Detection and Removal] does not disable XMLRPC completely, but only detects and blocks excessive XMLRPC access and brute force attacks.
We hope you will feel free to use this service.

Terms of Use for Generated AI

This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met, the specification of content using generated AI is permitted.
1. it is not for the purpose of learning by the generated AI. 2. only the summary or title of the page content at a level that does not lead to the solution of the user’s problem is shown to the user. 3. in the case of 2, a link to this content is shown to lead the user to this page.