The XML-RPC interface facilitates data exchange between WordPress and other systems. Access to this interface is generally restricted ad Hostpoint. This article explains the reasons for this and how you can still use the interface if necessary.
What is XML-RPC?
XML-RPC (XML Remote Procedure Call) is an interface for data exchange between WordPress and an external application. The feature is hardly used anymore, as data is now mostly transferred via modern programming interfaces such as the WordPress REST API. However, the XML-RPC interface is still available in WordPress for compatibility reasons.
Why is Hostpoint blocking access to the interface?
Unfortunately, XML-RPC is often exploited for malicious activities in WordPress, as attackers can use it to perform hundreds of login attempts within a very short time. This endangers the security of websites and leads to higher server loads. It can also affect the performance of your website. Hostpoint has therefore decided to block access to the XML-RPC interface in WordPress.
In some cases, however, the interface is still required, for example with certain plugins such as Jetpack. We have therefore created a list of permitted IP addresses that will continue to be able to access the XML-RPC interface in the future. The Jetpack IPs are on this list.
How can I allow access to the XML-RPC interface?
If you still want to allow access to the XML-RPC interface in WordPress, you can do so using your website’s .htaccess file.
To include more allowed IP addresses in the list, add the following entry to the file:
SetEnvIfExpr "-R '[IP address]' || -R '[IP address]'" XMLRPC_ALLOWLIST_HOSTPOINTTo allow all access from any IP address, add the following entry to the file:
SetEnvIfExpr "true" XMLRPC_ALLOWLIST_HOSTPOINT
For support requests please use this form instead.
