xmlrpc.php allows remote applications to talk to WordPress. It is also routinely abused for brute-force amplification, where a single request tests hundreds of passwords, and for pingback-based attacks.
Do you need it?
You need XML-RPC only if you use the WordPress mobile app, Jetpack, or a remote publishing tool. Most sites do not.
Method 1 — .htaccess (strongest)
Add this near the top of public_html/.htaccess:
<Files xmlrpc.php>
Require all denied
</Files>Requests are then rejected by the web server before PHP runs, which is the point — it saves resources as well as improving security.
Method 2 — plugin
Install Disable XML-RPC, or turn the option off in Wordfence or Solid Security.
Testing
Visit https://yourdomain.com/xmlrpc.php. Before blocking you will see a message about only accepting POST requests; after blocking you should get a 403 Forbidden.
If your mobile app stops connecting, remove the block — that is the expected trade-off.
