# Allow XML-RPC Only From Trusted IP Addresses

> Keeps XML-RPC available for the services you list (such as Jetpack or a publishing app on your office network) while answering every other XML-RPC request with a 403 error.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: xml-rpc, ip-allowlist, hardening
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-xmlrpc-ip-allowlist/

## Code

```php
// IP addresses or IPv4 CIDR ranges allowed to use xmlrpc.php.
$wpide_xmlrpc_ips = array( '127.0.0.1', '192.0.64.0/18' );

$wpide_xmlrpc_check = function () use ( $wpide_xmlrpc_ips ) {
    if ( ! defined( 'XMLRPC_REQUEST' ) || ! XMLRPC_REQUEST ) {
        return;
    }

    $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';

    foreach ( $wpide_xmlrpc_ips as $rule ) {
        if ( $rule === $ip ) {
            return;
        }
        if ( false !== strpos( $rule, '/' ) && filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
            list( $subnet, $bits ) = explode( '/', $rule, 2 );
            $mask = -1 << ( 32 - (int) $bits );
            if ( ( ip2long( $ip ) & $mask ) === ( ip2long( $subnet ) & $mask ) ) {
                return;
            }
        }
    }

    status_header( 403 );
    exit;
};

if ( did_action( 'init' ) ) {
    $wpide_xmlrpc_check();
} else {
    add_action( 'init', $wpide_xmlrpc_check, 0 );
}
```

## Notes

Replace the example addresses with your own; Jetpack publishes its current IP ranges in its documentation.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Allow XML-RPC Only From Trusted IP Addresses" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/