How to Enable the XML RPC Protocol

HostStage offers a high level of security on your web hosting account. We have therefore implemented a new security layer blocking by default the XMLRPC.php file of your wordpress installation by default. 
The reason is that it constitutes a great vulnerability in your wordpress websites security. 
As a matter of fact, throughout our network we have discovered there is a popular way to attack your website by simply pinging your xmlrpc.php file of your wordpress website from multiple others wordpress websites.  
While it doesn't affect our servers directly, due to resources isolation, it will generate a downtime on your website. 

Since, it requires a very few amount of resources to put down a wordpress website it became quite popular.
Also, since the attacks is based from others websites, it may also involve your website into some outgoing DDoS attacks. (You can check the Sucuti website whether your website was involved in such attacks). 

What is the XML RPC Protocol ?


The XML RPC protocol of wordpress behaves just as an API (Application Porgram Interface) allowing a remote access to your webistes to adminster it. 
Thanks to this feature you will be able to publish, edit, delete a blog post / article, upload medias, list and edit  your comments, change some administration options in settings,  and list, edit, delete publish new categories.

How to enable the XML RPC Protocol for my website ?


Giving the gain of features and some popular plugins relying on this very protocol (Jetpack), you have of course the possiblity to unblock it directly from your control panel. 
You can find the steps below : 

1) Login to your FTP account and list your public_html directory or your addon domain directory. 

2) Find and download the .htaccess file of your website. 

3) Append the code below : 

<Files xmlrpc.php>
order allow,deny
allow from all
</Files>


This will forcefully allow the XML RPC protocol on your website. 

4) In order to protect yourself from DDoS attacks, we would recommend you to install the 2 following plugins : 

- Wordfence Security: This plugin would protect you from Brute force attacks based on the xmlrpc.php by banning client file along with protecting your websites from many vulnerabilities.
- Disable XML-RPC Pingback : It will block the pingback feature of your website preventing it from participating to attacks. 


**Please note that if you have subdomains, addon domains using wordpress inside your public_html directory. This rule will be passed to them and it would expose you to DDoS attacks on all your wordpress installations so it would be recommeded to install the plugins on all your websites.**

  • 3 Users Found This Useful
Was this answer helpful?

Related Articles

How to Create An Addon Domain in cPanel

Description : Disclaimer : This how to assumes that you have changed your DNS settings at your...

Is the Shell Access Available on Shared Web Hosting Accounts?

Is the Shell Access (SSH) available on our Shared Web Hosting offers?Yes, we do offer a SSH...

How To Set Up A Cron Job with cPanel

All of our shared web hosting plans are coming with the possibility to set up cron...

How to Make a cPanel Full Account Backup

Description : Learn How to create your own Website BackupNote : With this tutorial you'll be able...

How to Create a MySQL Database in cPanel

Note : This tutorial will teach you how to create a database and how to add an authorized user to...