XML-RPC is an older way for apps to talk to WordPress. The xmlrpc.php file is also a favourite target for password-guessing and denial-of-service attacks, so our firewall filters traffic to it.
Trusted apps and networks can still use it, including:
- Jetpack and other WordPress.com (Automattic) services
- The official WordPress apps for Android and iPhone
- Zapier and IFTTT
- Open Live Writer, Ulysses, Blogo and BlogStomp
Requests from web browsers and unknown sources are blocked, so if you open yourdomain.com/xmlrpc.php in a browser you'll see an error. That's expected and nothing to worry about.
Most modern tools connect through the WordPress REST API instead. If an app you use needs XML-RPC and isn't on the list, contact support with the app's name and we'll review whether it can be allowed.