Why should you disable xmlrpc.php?

[mouakter13]

In early versions of WordPress, XML-RPC was disabled by default. But since version 3.5, it has been enabled by default. The main reason for this was to allow the WordPress mobile app to talk to the WordPress installation .

If you used the WordPress mobile app before version 3.5, you may remember having to enable XML-RPC on your site in order for the app to be able to publish content. This is because the app wasn't running WordPress itself, but was instead a separate application that communicated with your WordPress site using xmlrpc.php.

But it wasn't just the mobile app that was used for XML-RPC: it was also used to enable communication between WordPress and other blogging platforms, enabled trackbacks and pingbacks , and powered the czech republic phone number data Jetpack plugin that links a self-hosted WordPress site to WordPress.com .

But since the REST API was integrated into WordPress core, the xmlrpc.php file is no longer used for this communication. Instead, the REST API is used to communicate with the WordPress mobile app, desktop clients, other blogging platforms, WordPress.com (for the Jetpack plugin), and other systems and services. The range of systems that the REST API can interact with is much larger than that allowed by xmlrpc.php. Plus, there is much more flexibility.

Because REST API has replaced XML-RPC, you should now disable xmlrpc.php on your site. Let's see why.