WordPress’te XML-RPC Nasıl Devre Dışı Bırakılır (Güvenli Yöntem)

47 yorumBir Cevap Bırakın

1. Syed Balkhi says

   Tem 4, 2024 2:24 pm'de

   Hey WPBeginner readers,
   Did you know you can win exciting prizes by commenting on WPBeginner?
   Every month, our top blog commenters will win HUGE rewards, including premium WordPress plugin licenses and cash prizes.
   You can get more details about the contest from here.
   Start sharing your thoughts below to stand a chance to win!

2. Jiří Vaněk says

   Ara 13, 2023 2:22 am'de

   Thank you for the snippet. In the end, I disabled XML-RPC using WPCode because it seemed like the easiest way, and I can also easily revert XML-RPC back. Great!

   Yanıtla

3. Pete Mason says

   Eyl 9, 2021 9:02 am'de

   in htaccess, the line:
   allow from 123.123.123.123
   Looks like it wants to be edited with my IP address. But this is not stated anywhere —?

   Yanıtla

4. Christine says

   Şub 23, 2021 9:36 am'de

   Is there a difference between disabling and blocking?

   Yanıtla

   • WPBeginner Support says

     Şub 24, 2021 9:07 am'de

     Blocking would attempt to limit access to the feature while disabling would turn it off completely. If you disable it you wouldn’t need to worry about someone accessing it through a different method.

     Yanıtla

     Yönetici

5. Rashmi K says

   Kas 21, 2020 2:22 am'de

   The recomnended plugin Disable XML-RPC has not been updated since last 2 years. It says the plugin has not been tested with the last 3 releases of wordpress.

   Yanıtla

   • WPBeginner Support says

     Kas 23, 2020 11:43 am'de

     For our stance on the not tested warning, you would want to take a look at our article below:

     https://www.wpbeginner.com/opinion/should-you-install-plugins-not-tested-with-your-wordpress-version/

     Yanıtla

     Yönetici

6. Nikhil says

   Eki 10, 2020 12:55 am'de

   Hi,

   Will disabling the xmlrpc.php access also disable the access to wordpress apis used for android/ios app development?

   Yanıtla

   • WPBeginner Support says

     Eki 12, 2020 10:27 am'de

     That would depend on the API being used by the apps themselves.

     Yanıtla

     Yönetici

7. Vyom says

   May 31, 2020 12:28 am'de

   Found the solution:
   Adding following information in nginx config:
   # nginx block xmlrpc.php requests
   location /xmlrpc.php {
   deny all;
   }

   Yanıtla

8. Vyom says

   May 24, 2020 12:19 pm'de

   I use nginx instead of Apache. Can I still use .htaccess on my site?
   And do I need to store this file in public_html directory, or one level above it?

   Yanıtla

   • WPBeginner Support says

     May 27, 2020 8:40 am'de

     If you’re using nginx then you would not be able to use htaccess

     Yanıtla

     Yönetici

     • Vyom says

       May 27, 2020 11:31 pm'de

       Thanks for the reply. So is there an alternative for nginx?

       Yanıtla

       • WPBeginner Support says

         May 28, 2020 8:47 am'de

         You would add the site-specific plugin or the plugin from earlier in the article.

9. Chinecherem Somto says

   Mar 30, 2019 6:41 pm'de

   hi, is it on the .htaccess file on the website root that i will paste the code?

   Yanıtla

   • WPBeginner Support says

     Nis 1, 2019 1:14 pm'de

     Yes, the .htaccess in your site’s root folder is where you would add the .htaccess code

     Yanıtla

     Yönetici

10. Mojtaba Rezaeian says

    Ara 19, 2018 6:16 pm'de

    Thank you author.

    Yanıtla

    • WPBeginner Support says

      Ara 20, 2018 9:59 am'de

      You are welcome Mojtaba

      Yanıtla

      Yönetici

11. Bapi says

    Kas 25, 2017 12:32 am'de

    How to use multiple ip or a ip range like 123.123.123.1, 2, 3, …… 100,101

    Yanıtla

12. malcolm says

    Nis 27, 2017 2:38 pm'de

    why would we allow 123.123.123.123 ?

    If we aren’t using the service at all, why not let “deny all” be absolute?

    Yanıtla

    • Edward says

      May 25, 2017 10:26 pm'de

      If i’m reading the code correctly;
      order deny,allow – puts deny before allow, since deny is ‘all’ then allow isn’t processed
      deny from all – does what it says
      allow from 123.123.123.123 – is a place holder

      I gather that if you have a fixed IP address you could change order to “allow,deny” and replace 123.123.123.123 with your IP address. That would allow your IP then deny all others.

      Yanıtla

13. David Hoy says

    Nis 3, 2017 5:13 pm'de

    Thanks WP-Beginner, I’m trying to be baddest WP boy in my neighbourhood and this is exactly why I keep coming back to you guys, each question I have you say; here is the easy way, and here is the RIGHT way

    Me an my .htaccess are going to have a little chat about htpasswrd and this here XMLRPC thingy my clients will never need.

    You all just made my corner of the net a little bit safer, as MailChimp would say: High Fives!

    Yanıtla

    • WPBeginner Support says

      Nis 4, 2017 4:15 am'de

      Hey David,

      Thanks for the kind words. We are glad you find WPBeginner helpful

      Yanıtla

      Yönetici

14. Cezar says

    Eki 4, 2016 7:22 am'de

    Ok, i will use this code but i want IFTTT to have work on my website what i need to add?

    # Block WordPress xmlrpc.php requests

    order deny,allow
    deny from all
    allow from 123.123.123.123

    Yanıtla

15. PhilB says

    Ağu 31, 2016 9:32 am'de

    Hi,

    I have followed the instructions to block the xmlrpc.php file using .htaccess but im not sure if it is working.

    Im using wordfence security and in the live traffic view i can see the requests for the xmlrpc.php file have stopped, but if i check my access logs

    tail -f /apache2/logs/access_log

    I can still see the requests coming in, but the code at the end has changed from 500 to 403. Im concerned im getting a false report from my WordFence plugin and that im still being flooded with spam. Can anyone advise?

    Thanks,

    PhilB

    Yanıtla

    • David Hoy says

      Nis 3, 2017 5:09 pm'de

      Oh yeah! Thats working perfectly, your XMLRPC is FORBIDDEN!

      HTTP Status Code 403: The server understood the request but refuses to authorize it.

      Yanıtla

16. Raymundo says

    Ağu 10, 2016 3:45 am'de

    I got a weird problem…

    I’m using my wordpress blogs with IFTTT and all worked fine, until I integrated it with MaxCDN; IFTTT immediately stopped working. I did some research and the problem might be related to XML-RPC that was de-activated.

    When I check my dashbord in “Settings” > “Writing” , I don’t see anything like XML-RPC, Remote Publishing, etc. I’ve checked database in options, also xml-rpc not available / missing.

    I need to activate XML-RPC to keep my IFTTT working.

    How do I re-activate XML-RPC; all I need is a script that I can add in .htaccess or functions.php to activate XML-RPC.

    And why am I missing the XML-RPC funtionality in my dashboard.

    Thank You!

    Yanıtla

17. Muhammad Ammar Ashfaq says

    Haz 24, 2016 8:26 am'de

    I was searching for how to add this file xmlprc.php to my wordpress i am using 4.5.3 version and i came to this page. I need to add this php file because when i enable jetpack i got error of site_inaccessible. Please tell me hot to resolve this error my site is

    Yanıtla

    • WPBeginner Support says

      Haz 24, 2016 9:52 pm'de

      Connect to your WordPress site using FTP client or File Manager in cPanel. In your website’s root directory look for xmlrpc.php file. If it is there, then try step 2. If it isn’t then download a fresh copy of WordPress. Unzip and extract it and upload xmlrpc.php file back to your site’s root directory.

      Step 2: Check your WordPress theme’s functions file for the code that disables XML-RPC.

      Step 3: Check your .htaccess and wp-config files.

      Yanıtla

      Yönetici

18. omonaija says

    Haz 22, 2016 2:53 pm'de

    Please,what can i do to enable xmlrpc on my site?because i can’t login using wordpess mobile app on my smartphone..

    Yanıtla

    • WPBeginner Support says

      Haz 22, 2016 10:25 pm'de

      If you are using a security plugin on your WordPress site, then check its settings.

      Yanıtla

      Yönetici

19. Mook says

    Nis 19, 2016 9:43 pm'de

    Booyah! This WP filter fixed the script kiddie attack. I still firewalled the person, but I don’t have to watch the logs like a hawk to add more IPs to the firewall. THANK YOU.

    Yanıtla

    • WPBeginner Support says

      Nis 20, 2016 1:07 pm'de

      That’s why we use Sucuri.

      Yanıtla

      Yönetici

      • Alex says

        Nis 22, 2016 1:00 pm'de

        Is that because Sucuri acts like the Disable XMLRPC plugin?

        If so I can remove my Disable XMLRPC plugin,

        Thanks

        Alex

        Yanıtla

        • WPBeginner Support says

          Nis 24, 2016 3:52 pm'de

          Sucuri acts like a firewall between your site and users. It blocks any suspicious activity before it could reach your website.

20. Chad says

    Mar 20, 2016 5:18 pm'de

    I’m totally onboard for disabling xmlrpc.php server wide in my /etc/httpd/conf/includes/pre_main_global.conf file. But I am left with this questions…is there a way to determine that a particular plugin “NEEDS” xmlrpc.php in order to work? I have concerns with blocking access to it and then having an issue 2 months down the road and not know that the issue is with the fact that I blocked xmlrpc.php previously.

    Are there any common signs to look for in a log file or such which would point to a xmlrpc.php block as the cause?

    Yanıtla

21. Soumitra says

    Şub 12, 2016 4:30 am'de

    Hi, I just installed the plugin , Disable XML-RPC

    Lets see!

    Yanıtla

22. Phranq says

    Oca 31, 2016 8:20 pm'de

    Hey am using WordPress app to post with my android smartphone. Now I can’t login and my login credentials are correct. The response I got was ” we can’t log you in couldn’t connect to the WordPress site”.Could you help me fix this WordPress app login error.

    Yanıtla

    • WPBeginner Support says

      Şub 1, 2016 12:04 pm'de

      If you had disabled XML RPC then you may not be able to login using WordPress mobile app. Look in your theme’s functions.php file for this code

      add_filter('xmlrpc_enabled', '__return_false');

      Hosted with ❤️ by WPCode

      
      1-click Use in WordPress

      If it is there, then you need to remove it. You can also try deactivating plugins and turning them on one by one until you find the plugin that is stopping you from login using WordPress mobile app.

      Yanıtla

      Yönetici

23. Josiah says

    Ara 18, 2015 8:01 am'de

    It’s worth noting, that “allow from 123.123.123.123” is optional, and if used should be updated to include your IP, or the IP of the device that needs access to xmlrpc.php (it would be good to cite examples in this article).

    Yanıtla

24. Natalie says

    Ara 10, 2015 4:56 pm'de

    I am using GoodbyeCaptcha plugin to turn off the XML-RPC and works with no problem while Jetpack is activated.
    Hope it helps

    Yanıtla

25. ATI says

    Kas 28, 2015 9:34 pm'de

    Sorry, I’ve tried this method many times. It didn’t work for me – in fact it brought the front end down (blocking visitors read access to the web page) after adding these codes to the .htaccess file.

    Yanıtla

26. Gretchen Louise says

    Ağu 3, 2013 11:48 pm'de

    Does disabling it this way prevent this issue? http://theaffluentblogger.com/operating-a-website/wordpress-xmlrpc-php-vulnerability-affects-shared-hosting-sites/ I have a friend whose site is continually crashing because of her xmlrpc file being attacked.

    Yanıtla

    • Editorial Staff says

      Ağu 26, 2013 1:32 pm'de

      Yes it will prevent the attack to an extent.

      Yanıtla

      Yönetici

27. Christopher Ross says

    Kas 17, 2012 10:03 am'de

    Keith, there’s a trend in WordPress to move non-theme related functions out of the functions.php file and into a “site specific plugin”, basically a plugin that you only activate on one unique website and it stores the non-theme related functions for that site.

    You can accomplish the same thing by placing the code in your functions.php file.

    Yanıtla

    • Keith Davis says

      Kas 18, 2012 5:51 am'de

      Thanks Chris
      Looks like you guys have already covered it.
      https://www.wpbeginner.com/beginners-guide/what-why-and-how-tos-of-creating-a-site-specific-wordpress-plugin/

      BTW – what’s happened to your comments system?
      Was Livefyre then something related to twitter and facebook and now ?

      Yanıtla

28. Keith Davis says

    Kas 17, 2012 9:46 am'de

    Hi Guys
    Sorry to be a bit thick but could you expand on… “All you have to do is paste the following code in a site-specific plugin:”

    Which plugins are site specific?

    Yanıtla