Allow XML-RPC Only From Trusted IP Addresses
Keeps XML-RPC available for the services you list (such as Jetpack or a publishing app on your office network) while answering every other XML-RPC request with a 403 error.
Opens WPIDE on
Code
// IP addresses or IPv4 CIDR ranges allowed to use xmlrpc.php.
$wpide_xmlrpc_ips = array( '127.0.0.1', '192.0.64.0/18' );
$wpide_xmlrpc_check = function () use ( $wpide_xmlrpc_ips ) {
if ( ! defined( 'XMLRPC_REQUEST' ) || ! XMLRPC_REQUEST ) {
return;
}
$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
foreach ( $wpide_xmlrpc_ips as $rule ) {
if ( $rule === $ip ) {
return;
}
if ( false !== strpos( $rule, '/' ) && filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
list( $subnet, $bits ) = explode( '/', $rule, 2 );
$mask = -1 << ( 32 - (int) $bits );
if ( ( ip2long( $ip ) & $mask ) === ( ip2long( $subnet ) & $mask ) ) {
return;
}
}
}
status_header( 403 );
exit;
};
if ( did_action( 'init' ) ) {
$wpide_xmlrpc_check();
} else {
add_action( 'init', $wpide_xmlrpc_check, 0 );
}Notes
Replace the example addresses with your own; Jetpack publishes its current IP ranges in its documentation.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.