Restrict WordPress XML-RPC without guessing what will break

What is xmlrpc.php used for in WordPress?

XML-RPC is a remote communication interface used by some publishing tools and services. Its presence does not prove a vulnerability or infection. The security decision depends on whether the website uses it and whether the access is adequately controlled.

A browser response from xmlrpc.php is not enough to establish which methods remain available. Distinguish blocking password-based access from making the entire file unreachable. Sentinel protection should be described by the behavior it restricts, not by a promise that every request to that URL returns an error.

Limit XML-RPC abuse alongside normal login protection

A protected wp-login.php screen does not automatically mean every other password route is controlled. XML-RPC deserves a separate review when a site continues to receive login attempts or does not need remote publishing.

Use Sentinel XML-RPC protection alongside login attempt limits, secure account credentials and successful-login monitoring. Restricting one interface does not fix a vulnerable plugin or make a compromised administrator account safe.

Keep Jetpack and publishing integrations working

Sentinel recognizes selected active plugins that depend on XML-RPC and keeps access available for those dependencies. That compatibility check cannot identify every external app a customer uses. A mobile publishing app or a custom service can still need a website-specific exception.

Before changing the policy, check the tools used to publish, back up or manage the website. After a change, test the normal workflow. Review other WordPress hardening controls separately so XML-RPC exceptions do not become a reason to relax unrelated safeguards.