Disable XML-RPC and Pingbacks in WordPress

XML-RPC is an old protocol that allows remote access to WordPress through tools and apps. It also enables pingbacks, which are often used in spam or DDoS attacks. If you’re not using remote publishing or legacy tools, you can block this entry point completely. The JetHost Total Care disable XML-RPC and pingback setting makes it easy.

Why You Might Want to Disable XML-RPC and Pingbacks

XML-RPC iand Pingbacks aren’t needed on most modern WordPress sites. At one point, it helped bloggers connect with mobile apps or desktop editors – but today, most users don’t rely on it.

Disabling it helps you:

Block a common method used in brute force and DDoS attacks
Reduce spam from pingback and trackback features
Close an outdated protocol that adds no value to most websites

If you’re using the REST API or manage your site through the admin only, XML-RPC can safely be disabled.

What Is XML-RPC in WordPress?

XML-RPC allows external systems to interact with your WordPress installation. It can post content, approve comments, or retrieve data using a remote connection. Pingbacks are notifications between blogs and also rely on this feature.

The problem: bots and attackers often abuse it to flood your site with requests or test login credentials.

How to Disable XML-RPC and Pingbacks with JetHost Total Care

To control autosave using JetHost Total Care:

1. Log in to your WordPress dashboard.
2. Open the JetHost Total Care section from the sidebar.
3. In the tab Security, look for the setting labeled Disable XML-RPC and Pingback.
4. Toggle the switch to activate the block.

JetHost Total Care disable XML-RPC and pingbacks

JetHost Total Care saves the change automatically when you toggle the setting.

JetHost Total Care Security setting updated

What Happens After You Turn It Off

Once you disable XML-RPC, all remote access through this system stops. Pingbacks and trackbacks will also be blocked. You’ll still be able to use the REST API and manage your site normally through the WordPress dashboard.

If you use tools like Jetpack or remote apps, double-check whether they still require XML-RPC before turning it off.

JetHost Experts Tip

If you’ve never connected your WP site to a mobile app, desktop editor, or external system, chances are you don’t need XML-RPC at all. Disabling it can immediately reduce spam and attack attempts.

Need More Help?

The JetHost Total Care disable XML-RPC and pingbacks feature helps close off one of the oldest and most frequently targeted WordPress gateways. It’s a simple step that gives you stronger control over what gets in and what doesn’t. Take a look at more WordPress security guides to stay ahead of common issues.