XML-RPC stays open after WordPress updates
The XML-RPC blocking plugin stops closing xmlrpc.php after WordPress updates, so XML-RPC methods stay available on the site.
Tier I · Proven The best-established problems.
5 public reports · first reported 5 August 2018 · last reported 6 July 2026
What's going wrong
Site owners report that this XML-RPC blocking plugin stops working after WordPress core updates, including moves from 5.x to 6.4. The xmlrpc.php file stays reachable, and checker tools still report every XML-RPC method as available, so the site remains exposed to brute-force and pingback abuse without the owner noticing. Some reviewers work around the gap by restricting file permissions or blocking the file in the server configuration by hand. The opportunity is a reliable way to verify that XML-RPC is actually closed after each update and to alert owners when it reopens, which hosting companies and agencies managing many sites would value.
AI-assisted: written with the help of AI from the reports.
Products affected
Disable XML-RPC.
Related problems
Who has this problem
1 business found.
Unlock them at the top of this page — $19.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.