# Endpoint & Access Risks

Endpoint & Access Risks

# XML-RPC Enabled

## What This Means

This finding indicates that the WordPress XML-RPC interface is enabled and accessible on your site.

XML-RPC allows remote access to WordPress functionality.

---

## Why It Matters

While XML-RPC has legitimate uses, it is commonly targeted by attackers.

It can be used for:

- brute force login attempts  
- amplification attacks (e.g., pingback abuse)  
- automated access to site functionality  

If not required, it increases your site's attack surface.

---

## How Steel Security Detects This

Steel Security checks whether the XML-RPC endpoint (`xmlrpc.php`) is accessible.

If the endpoint responds to requests, it is flagged as enabled.

---

## How to Fix It

To resolve this issue:

- disable XML-RPC if it is not needed  
- restrict access to the XML-RPC endpoint  
- apply Steel Security hardening controls related to XML-RPC  

---

## What to Expect After Fixing

After applying protections:

- XML-RPC access will be blocked or restricted  
- automated attacks using XML-RPC will be reduced  
- there should be no impact if XML-RPC is not in use  

---

## How to Verify

To verify the fix:

1. attempt to access `/xmlrpc.php`  
2. confirm that access is blocked or restricted  

---

## Common Causes

- default WordPress configuration (XML-RPC enabled by default)  
- legacy integrations using XML-RPC  
- lack of endpoint restrictions  

---

## Best Practices

- disable XML-RPC unless it is required  
- restrict access if partial functionality is needed  
- monitor for unusual activity targeting XML-RPC  
- combine with other endpoint protections  

---

## Related

- [Restrict XML-RPC](https://docs.steelsecurity.com/books/hardening-reference/page/restrict-xml-rpc)
- [Restrict Sensitive Endpoints](https://docs.steelsecurity.com/books/hardening-reference/page/restrict-sensitive-endpoints)
- [Direct PHP Access Allowed](https://docs.steelwp.com/books/findings-reference/page/direct-php-access-allowed)

# Sensitive Endpoints Accessible

## What This Means

This finding indicates that one or more sensitive endpoints on your site are publicly accessible without restriction.

These endpoints may expose functionality that is commonly targeted by automated attacks.

---

## Why It Matters

Sensitive endpoints are entry points into your application.

Examples include:

- `wp-login.php`  
- `xmlrpc.php`  
- REST API endpoints  

If left unrestricted, attackers may:

- perform brute force login attempts  
- probe application behavior  
- abuse exposed functionality  
- automate large-scale attacks  

Restricting access reduces unnecessary exposure.

---

## How Steel Security Detects This

Steel Security checks whether commonly targeted endpoints are accessible without restriction.

If these endpoints respond to requests in an unrestricted manner, they are flagged.

---

## How to Fix It

To resolve this issue:

- restrict access to sensitive endpoints  
- limit exposure based on usage and requirements  
- apply Steel Security hardening controls related to endpoint protection  

---

## What to Expect After Fixing

After applying protections:

- access to sensitive endpoints will be limited  
- automated attack traffic may be reduced  
- legitimate functionality should continue to work if properly configured  

---

## How to Verify

To verify the fix:

1. attempt to access sensitive endpoints directly  
2. confirm that access is restricted under expected conditions  

Test both:

- authorized access (should work)  
- unauthorized access (should be limited or blocked)  

---

## Common Causes

- default WordPress exposure of login and API endpoints  
- lack of access restrictions  
- publicly accessible endpoints without controls  

---

## Best Practices

- restrict endpoints that are not required  
- limit access where possible  
- monitor access patterns  
- combine with other access and execution controls  

---

## Related

- [Restrict Sensitive Endpoints](https://docs.steelsecurity.com/books/hardening-reference/page/restrict-sensitive-endpoints)
- [XML-RPC Enabled](https://docs.steelwp.com/books/findings-reference/page/xml-rpc-enabled)
- [Direct PHP Access Allowed](https://docs.steelwp.com/books/findings-reference/page/direct-php-access-allowed)