xmlrpc.php open

Why it matters

Limits on login attempts often only watch the login page. Through xmlrpc.php a bot can guess passwords in bulk without being stopped. Hardly any site still needs it.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It asks xmlrpc.php the way any visitor can and checks whether it answers, and whether it allows many requests in one (multicall).

Common causes

• WordPress leaves xmlrpc.php open by default
• An old app or service that used it
• No security plugin or server rule that closes it

How to fix it

1. Check whether you use the Jetpack or WordPress app. They may still need it.
2. Switch off xmlrpc.php with a security plugin or a rule in .htaccess.
3. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "An old back door is open for guessing passwords". When everything is in order, the report says: "The old xmlrpc back door is closed".