Disabling XML-RPC in WordPress can be beneficial for several reasons:

1. Security Concerns: XML-RPC has been targeted by attackers in various types of malicious activities:
   1. Brute Force Attacks: Attackers can use XML-RPC to amplify their brute force attacks. Instead of trying different passwords with one request per attempt, they can make multiple attempts in a single request using XML-RPC’s `system.multicall` method. This allows attackers to more efficiently try a larger number of password combinations.
   2. DDoS Attacks: XML-RPC can be exploited for Distributed Denial of Service (DDoS) attacks. This is because certain XML-RPC requests can be resource-intensive and, if made in large numbers, can overwhelm a server.
   3. Exploits: There have been known vulnerabilities in the past related to XML-RPC that attackers have exploited.
2. Performance: Certain XML-RPC requests, especially those made during attacks, can be resource-intensive. Disabling XML-RPC can help in reducing the load on your server and ensure smooth performance.
3. Reduced Exposure: The principle of least privilege dictates that you should only expose functionalities that are absolutely necessary. If you don’t need XML-RPC functionality, it’s better to disable it to reduce the potential attack surface.
4. Limited Use Cases for Many: XML-RPC was initially developed to allow remote publishing to WordPress from third-party applications. However, with the advent of the REST API in WordPress, many of the legitimate use cases for XML-RPC have diminished.
5. Blocking Unwanted Traffic: There are numerous bots and scanners on the internet that specifically target XML-RPC endpoints. By disabling it, you can reduce unwanted and potentially malicious traffic to your website.
6. Compatibility and Maintenance: As the WordPress ecosystem evolves, older protocols and features (like XML-RPC) might become less supported or even deprecated. By not relying on them, you ensure better compatibility and easier maintenance in the long run.

If you are using specific features or plugins that require XML-RPC, you should weigh the benefits against the potential risks. If you decide to keep it enabled, consider implementing security measures like limiting access to the XML-RPC endpoint, monitoring for suspicious activity, and using security plugins that can protect against common XML-RPC exploits.

Want to disable XML-RPC?

Do it with our free plugin!