# WordPress: XML-RPC server accepts POST requests only (xmlrpc.php)

**Code:** `XML-RPC server accepts POST requests only` · **Category:** WordPress · **Seen on:** WordPress

You opened xmlrpc.php in a browser (GET) — it’s an API endpoint, not a page. Heavy POST traffic to it usually means brute-force bots.

## Meaning

XML-RPC serves old apps/Jetpack/pingbacks. Bots abuse it for password guessing (system.multicall) and DDoS pingbacks. If you don’t need it, block it.

## Common causes

- Visiting xmlrpc.php directly (expected message)
- Bot traffic hammering xmlrpc.php
- Jetpack/mobile app requiring it

## Quick fix

1. Ignore the message if you opened it in a browser
2. Block xmlrpc.php at the web server if unused
3. Use security plugins to limit XML-RPC

## Detailed fix by platform

### Apache

1. 

```apache
<Files xmlrpc.php>
  Require all denied
</Files>
```


### Nginx

1. `location = /xmlrpc.php { deny all; }`

## How to diagnose

1. **Traffic** — Requests to xmlrpc.php in access logs
2. **Usage** — Jetpack/app needs it?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/wordpress/xml-rpc-server-accepts-post-requests-only)