Every WordPress installation includes a file called xmlrpc.php, which was originally designed to help third-party apps and remote platforms communicate with your website. However, in today's modern web environment, this file is rarely used by standard website owners and has instead become a massive target for automated bots and brute-force attacks. When malicious bots constantly send requests to this file, it can drain your server resources, cause CPU spikes, and significantly slow down your website for actual visitors.

By blocking access to this outdated file directly from your hosting control panel, you can instantly eliminate this unnecessary server load and secure your website against common vulnerabilities.

Step 1: Locating Your .htaccess File

The most effective way to block XML-RPC requests is by adding a simple rule to your website's hidden configuration file.

• Log in to your Sternhost cPanel account.

• Navigate to the Files section and click on File Manager.

• In the top right corner, click Settings and ensure the 'Show Hidden Files (dotfiles)' box is checked.

• Open your website's main folder (usually public_html).

• Right-click on the .htaccess file and select Edit.

Step 2: Adding the Block Rule

Once the file editor is open, you can easily instruct the server to reject any requests targeting the xmlrpc.php file.

• Scroll to the very bottom of the file. Do not place this inside the default WordPress tags.

• Copy and paste the following snippet directly into the editor:

<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>

• Click the Save Changes button in the top right corner to instantly apply the block.

Why Disabling XML-RPC is Crucial

• Stops CPU Spikes: It immediately halts automated bots from bombarding your server with login attempts, freeing up your CPU and RAM.

• Improves Overall Speed: With fewer junk requests processing in the background, your server can dedicate all its power to delivering your website's pages to real users faster.

• Enhances Security: It completely closes off one of the most common entry points malicious scripts use to exploit WordPress sites.