How is xmlrpc.php from Drupal core affecting functionality?

Given the fact that a vulnerability was discovered for it, details in this article

  • is it safe to remove xmlrpc.php file?

  • Is it bad practice? If so, why?

  • Is there any way to neutralize this security risk without removing this file?


is it safe to remove xmlrpc.php file?

Yes, if you're not expecting anyone to use it.

Is it bad practice? If so, why?

Could be construed as such; any change to core creates an additional step when updating (I'm sure we're all aware of the dangers of 'hacking core' by now, but if not: Never Hack Core).

Is there any way to neutralize this security risk without removing this file?

Update your core to 7.31, where the vulnerability has been fixed.

  • Thank you for your answer, I am well aware that hacking core is something to be avoided, and I know you should take extra measures when updating. One thing I forgot to ask is, if that file is removed, will it solve the security threat? – Dragos Damian Aug 7 '14 at 18:14
  • As far as I'm aware the vulnerability was only in that file, so yes, getting rid of it should solve the problem – Clive Aug 8 '14 at 16:11
  • Actually strike that, other files have also changed related to the limit for ddos - so upgrading is the safest option – Clive Aug 12 '14 at 14:03
  • Removing xmlrpc.php and ditching some .txt files is less hacky than actually changing robots.txt and .htaccess, which I often find necessary already in moderately complex projects. – fifi finance Sep 17 '14 at 12:18

In case you are not aware (sorry if you already know this), but XMLPRC is used for posting content remotely. The xmlrpc.php file is what Wordpress uses to allow you to post remotely.

As you know, one of the things we all love about Wordpress is how easy it is to create new websites and to manage the content. These are the very same reasons why hackers also love Wordpress.

If you are not posting comments to your website remotely, one of the quickest way to get yourself out of this situation is to rename the xmlrpc.php file to some fictitious name. Make sure you change the file type to anything other than “.php.” This way, you will remove the possibility that the server may accidentally run the code.

If you are doing posts remotely, here’s some code you can add to your .htaccess file:

order deny,allow deny from all allow from 123.456.789.123 allow {where “123.456.789.123” is the IP address of the computer that can use xmlrpc.pgp}

Wordpress has a bunch of security holes and we have been victimized many times. I a solution that so far has helped me secure our sites more than anything else we have tried.

Here is the link ==> http://jvz8.com/c/9278/20094

Hopefully, Wordpress will not open up new holes with the next WP update.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.