How to Disable XML-RPC in WordPress on Hostinger: Stop Brute-Force & Pingback Floods

What is XML-RPC and Why is It a Security Liability?

Introduced in early versions of WordPress, xmlrpc.php allowed external applications (like the WordPress mobile app or remote blogging clients) to communicate with your site via XML requests. However, since the introduction of the official WordPress REST API in 2016, XML-RPC has become largely obsolete. Today, cybercriminals exploit XML-RPC's system.multicall method to test hundreds of password combinations in a single HTTP payload, bypassing standard login attempt rate limiters and consuming 100% of your server CPU.

Method 1: Blocking XML-RPC via .htaccess in Hostinger hPanel

Open Hostinger hPanel -> File Manager, locate public_html/.htaccess, and paste this block at the very top:

# Block WordPress XML-RPC Attacks
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

Method 2: Blocking via Cloudflare WAF

If you route your domain through Cloudflare, create a custom WAF Firewall Rule: (http.request.uri.path eq "/xmlrpc.php") -> Action: Block. Malicious requests will be dropped at the Cloudflare edge without touching your Hostinger origin server.