XML-RPC in WordPress: The Security and Performance Risk You Should Disable

XML-RPC is a remote procedure call protocol that WordPress has supported since before the REST API existed. It allows external applications to communicate with your WordPress site — but in 2026, it is mostly a liability. What XML-RPC Does XML-RPC (xm...