Endpoint & Access Risks
Endpoint & Access Risks
XML-RPC Enabled
What This Means
This finding indicates that the WordPress XML-RPC interface is enabled and accessible on your site.
XML-RPC allows remote access to WordPress functionality.
Why It Matters
While XML-RPC has legitimate uses, it is commonly targeted by attackers.
It can be used for:
- brute force login attempts
- amplification attacks (e.g., pingback abuse)
- automated access to site functionality
If not required, it increases your site's attack surface.
How Steel Security Detects This
Steel Security checks whether the XML-RPC endpoint (xmlrpc.php) is accessible.
If the endpoint responds to requests, it is flagged as enabled.
How to Fix It
To resolve this issue:
- disable XML-RPC if it is not needed
- restrict access to the XML-RPC endpoint
- apply Steel Security hardening controls related to XML-RPC
What to Expect After Fixing
After applying protections:
- XML-RPC access will be blocked or restricted
- automated attacks using XML-RPC will be reduced
- there should be no impact if XML-RPC is not in use
How to Verify
To verify the fix:
- attempt to access
/xmlrpc.php - confirm that access is blocked or restricted
Common Causes
- default WordPress configuration (XML-RPC enabled by default)
- legacy integrations using XML-RPC
- lack of endpoint restrictions
Best Practices
- disable XML-RPC unless it is required
- restrict access if partial functionality is needed
- monitor for unusual activity targeting XML-RPC
- combine with other endpoint protections
Related
Sensitive Endpoints Accessible
What This Means
This finding indicates that one or more sensitive endpoints on your site are publicly accessible without restriction.
These endpoints may expose functionality that is commonly targeted by automated attacks.
Why It Matters
Sensitive endpoints are entry points into your application.
Examples include:
wp-login.phpxmlrpc.php- REST API endpoints
If left unrestricted, attackers may:
- perform brute force login attempts
- probe application behavior
- abuse exposed functionality
- automate large-scale attacks
Restricting access reduces unnecessary exposure.
How Steel Security Detects This
Steel Security checks whether commonly targeted endpoints are accessible without restriction.
If these endpoints respond to requests in an unrestricted manner, they are flagged.
How to Fix It
To resolve this issue:
- restrict access to sensitive endpoints
- limit exposure based on usage and requirements
- apply Steel Security hardening controls related to endpoint protection
What to Expect After Fixing
After applying protections:
- access to sensitive endpoints will be limited
- automated attack traffic may be reduced
- legitimate functionality should continue to work if properly configured
How to Verify
To verify the fix:
- attempt to access sensitive endpoints directly
- confirm that access is restricted under expected conditions
Test both:
Common Causes
- default WordPress exposure of login and API endpoints
- lack of access restrictions
- publicly accessible endpoints without controls
Best Practices
- restrict endpoints that are not required
- limit access where possible
- monitor access patterns
- combine with other access and execution controls