Title: WordPress blocking XML-RPC
Last modified: December 18, 2023

---

# WordPress blocking XML-RPC

 *  Resolved [ccselkie](https://wordpress.org/support/users/ccselkie/)
 * (@ccselkie)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/wordpress-blocking-xml-rpc/)
 * I think that WordPress is blocking the XML-RPC on my server so I am not getting
   any website viewing analytics etc.
 * How do I stop this from happening?
 * Thanks

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Plugin Support [wfpeter](https://wordpress.org/support/users/wfpeter/)
 * (@wfpeter)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/wordpress-blocking-xml-rpc/#post-17288048)
 * Hi [@ccselkie](https://wordpress.org/support/users/ccselkie/), thanks for your
   question.
 * XML-RPC requests are one of the most common brute force/credential stuffing attack
   methods. Using long unique passwords and 2FA for your administrative accounts
   should let you open this up if it’s affecting functionality on your site. Notably
   Jetpack and the WordPress app might need it.
 * In your case, check that Wordfence’s “**Disable XML-RPC authentication**” isn’t
   checked **Wordfence > Login Security > Settings**. This route can also be blocked
   entirely using **.htaccess** so see if yours contains something like this and
   remove it:
 *     ```wp-block-code
       # Block WordPress xmlrpc.php requests
       <Files xmlrpc.php>
       order deny,allow
       deny from all
       </Files>
       ```
   
 * If XML-RPC is still blocked after checking .htaccess and Wordfence’s settings
   aren’t the cause, you may need to speak with your host to see if they block this
   by design.
 * Thanks,
   Peter.
 *  Thread Starter [ccselkie](https://wordpress.org/support/users/ccselkie/)
 * (@ccselkie)
 * [2 years, 9 months ago](https://wordpress.org/support/topic/wordpress-blocking-xml-rpc/#post-17293971)
 * Hello,
 * My host had blocked xmlrpc.php so we have now turned this off (see attached) 
   however, I am still not receiving the data.
 * What else can I do to fix this?
 *  Plugin Support [wfpeter](https://wordpress.org/support/users/wfpeter/)
 * (@wfpeter)
 * [2 years, 9 months ago](https://wordpress.org/support/topic/wordpress-blocking-xml-rpc/#post-17294007)
 * Hi [@ccselkie](https://wordpress.org/support/users/ccselkie/), thanks for checking
   those things and letting us know.
 * To rule Wordfence in/out as the cause for analytics not reaching its destination,
   place Wordfence in [Learning Mode](https://www.wordfence.com/help/firewall/learning-mode/).
   From the Wordfence Dashboard click on **Manage WAF**. Then you will see **Basic
   Firewall Options > Web Application Firewall Status**. Change the option to **
   Learning Mode**. You could then attempt to navigate your site, pull some stats,
   or any other activities that might make analytics appear. If they start to come
   through, switch the WAF from Learning Mode back to **Enabled and Protecting**
   to see if it continues to work afterwards.
 * If that doesn’t seem to make any difference, check your [Live Traffic](https://www.wordfence.com/help/tools/live-traffic/)
   page for cases of the bot or IP(s) of your analytics being blocked. When clicking
   the block line (or “eye” icon), it will state the reason in red text. In many
   cases, an “**ADD PARAM TO FIREWALL ALLOWLIST**” button appears in this section
   which you can click to allow these types of request in future.
 * Let us know if you see any reason given that you’re not sure how to solve. Sometimes
   following our instructions on “throttling” bots instead of blocking them can 
   yield results in this area: [https://www.wordfence.com/help/firewall/rate-limiting/](https://www.wordfence.com/help/firewall/rate-limiting/)
 * If you don’t see Wordfence blocking your analytics provider’s bot or related 
   traffic at all, you may need to speak with your host or analytics provider to
   see if everything else has been configured correctly.
 * Let us know how you get on,
   Peter.

Viewing 3 replies - 1 through 3 (of 3 total)

 The topic ‘WordPress blocking XML-RPC’ is closed to new replies.

 * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865)
 * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wordfence/)
 * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/)

 * 3 replies
 * 2 participants
 * Last reply from: [wfpeter](https://wordpress.org/support/users/wfpeter/)
 * Last activity: [2 years, 9 months ago](https://wordpress.org/support/topic/wordpress-blocking-xml-rpc/#post-17294007)
 * Status: resolved