XML-RPC is an outdated WordPress feature originally designed to allow remote connections from mobile apps and third-party publishing platforms. Today, modern REST APIs have replaced it, and the xmlrpc.php file is rarely used for its intended purpose. Instead, it has become one of the primary targets for malicious bots and hackers launching massive DDoS and brute-force password attacks. When botnets spam this file, it forces your server to work overtime, resulting in severe CPU exhaustion, 508 Resource Limit errors, and sluggish page loads for your real visitors.

Because you are hosting on Sternhost, you can instantly block all access to this vulnerable file at the server level. This neutralizes the attacks before they can consume your PHP resources or query your database.

Step 1: Accessing Your .htaccess File

You can block this file by adding a tiny snippet of code to your website's hidden configuration file directly from your hosting dashboard.

• Log in to your Sternhost cPanel account.

• Navigate to the Files section and click on File Manager.

• Click on Settings in the top right corner and check the box for 'Show Hidden Files (dotfiles)'.

• Open your website's main directory, which is typically named public_html.

• Right-click on the .htaccess file and select Edit.

Step 2: Adding the Block Rule

Once the text editor is open, you will add specific Apache server instructions that instantly reject any traffic trying to reach the XML-RPC file.

• Scroll to the very bottom of the document so you do not accidentally interfere with any of your existing WordPress configuration rules.

• Copy and paste the following snippet directly into the editor:

<Files xmlrpc.php>
Order Allow,Deny
Deny from all
</Files>

• Click the Save Changes button in the top right corner of the screen to apply the new security rule.

Why Disabling XML-RPC is a Critical Defense

• Eliminates Massive CPU Spikes: By denying access at the server level, your hosting account completely drops the malicious requests instead of executing heavy PHP processes to process them.

• Blocks Amplification Attacks: Hackers specifically exploit the XML-RPC file because it allows them to attempt thousands of username and password guesses in a single HTTP request; disabling it shuts down this high-volume vulnerability entirely.

• Protects Website Uptime: Keeping your server resources completely free from automated botnet spam ensures your website remains fast, stable, and online for your actual customers.