How to Disable XML-RPC in WordPress

In The Sky IT Posted on by

What Is XML-RPC in WordPress?

XML-RPC is a core WordPress API that has been enabled by default since WordPress 3.5 was released in 2012. It allows developers to use XML and HTTPS protocols to connect to and interact with your WordPress website. In short, you need XML-RPC enabled to access and publish your blog remotely, such as when you want to use a mobile app to manage your site or make connections to automation services.

However, if you’re not using mobile apps with your website, then it is advisable to disable XML-RPC as this closes a door that may potentially be exploited to hack your website. In this article, we are going to walk you through 3 methods to accomplish this.

Method 1: Disable WordPress XML-RPC With .htaccess (Advanced)

This method is for advanced users because it requires you to edit your site’s .htaccess file. This way has several advantages, such as the ability to give remote access to yourself and your team while restricting everyone else. It also won’t negatively affect your WordPress performance since it disables
XML-RPC requests before they are passed on to WordPress.

You will need to add the following code to your .htaccess file. You can do this by connecting to your site using an FTP client or file manager. Also, All in One SEO users can use the plugin’s built-in editor tool to add the code snippet, as you can see in the screenshot below.

1
2
3
4
5
6
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
 deny from all
allow from 123.123.123.123
</Files>

If you wish to give a certain user remote access to your site, then simply replace ‘123.123.123.123’ on line 5 with their IP address. You can add multiple IP addresses by separating them with spaces. Or, if you want to disable XML-RPC completely, then delete line 5 altogether.

Method 2: Disable WordPress XML-RPC With a Code Snippet (Recommended)

This method requires you to add some code to your WordPress website. WPCode is the easiest and safest way to add code to your WordPress site. It helps you to manage your code snippets and prevents any errors from breaking your site. In this method, we will use one of WPCode’s built-in code snippets to disable XML-RPC.

  • First, you need to install the free WPCode plugin.
  • Upon activation, head over to Code Snippets » Add Snippet. The WPCode library already contains a snippet that disables XML-RPC. You can find it by searching for ‘xml.’
  • Once you find it, you need to click the ‘Use snippet’ button.
  • Next, you need to switch the ‘Active’ toggle to the ‘On’ position.
  • Finally, make sure you click the ‘Update’ button to enable the snippet on your site and disable XML-RPC API.

Method 3: Disable WordPress XML-RPC With a Plugin

This is a simple method that can be used if you don’t want to add any other customizations to your website with a code snippet plugin

Simply install and activate the Disable XML-RPC-API plugin.

The plugin works out of the box and will immediately deactivate XML-RPC.

You can navigate to XML-RPC Security » XML-RPC Settings to configure the plugin. For example, you can allow certain users to access XML-RPC by whitelisting their IP addresses.

Testing That WordPress XML-RPC Is Disabled

Now you should check to make sure you successfully disabled the XML-RPC API on your WordPress website.

You can check that XML-RPC is disabled by simply visiting the URL http://example.com/xmlrpc.php in your browser. Make sure you replace ‘example.com’ with your own website’s domain name. If XML-RPC is disabled, you should see the error message: ‘Forbidden: You don’t have permission to access this resource.’

How to Change Your WordPress Admin Username

In The Sky IT Posted on by

Is It Possible to Change WordPress Usernames?

It has long been a complaint that it is difficult to change your username in WordPress. Usernames actually can’t be changed in WordPress. This can be frustrating and confusing to beginner WordPress users. So, in this article, we present you several workarounds that will accomplish the same end:

Method 1: Create a New User and Delete the Old One

The easiest way to change your WordPress username is by creating a new user with your desired username and with the administrator user role. The only catch is that you will need to use a different email address than the one used by your current account.

Note: If you are using Gmail, then you can insert a plus sign (+) with additional letters after your username. For example, if your email address is myname@gmail.com, then you can use the email address myname+wordpress@gmail.com. It will still go to the same email inbox, but WordPress will consider it a separate email address.

After creating the new account, you need to log out of your WordPress account and then log in with the new user account you just created. Next, head over to the Users » All Users page in your WordPress admin area and then click the ‘Delete’ link under your old username to remove it. When you delete the old username, WordPress will ask what you want to do with any content created by that user. Make sure that you click the ‘Attribute all content to’ option and then select the new user you just created. After that, you should click the ‘Confirm Deletion’ button to delete the old user account.

Congratulations, you have now successfully changed your WordPress username. If you want to use the same email address as before, then you can now change the email address of the new user.

Method 2: Use Easy Username Updated (Plugin Method)

Another simple way to change your WordPress username is by using a plugin. If you are concerned about using too many WordPress plugins, then don’t worry. You can safely delete the plugin once you have changed your WordPress username.

The first thing you need to do is install and activate the Easy Username Updater plugin.  Upon activation, simply go to the Users » Username Updater page and then click the ‘update’ link next to the username you want to change. Now, you simply enter the new username and then click the ‘Update Username’ button. If you’d like to notify the user about the change, then make sure you check the ‘Send User Notification’ box first.

That’s all! Now, you can remove the username changer plugin from your site.

Method 3: Change WordPress Username With phpMyAdmin (Advanced)

This method is a little bit complicated as it requires that you make direct changes to your WordPress database. We recommend that users avoid doing this if possible since it’s easy to make a mistake and cause errors on your WordPress site. However, in some cases, you may not have an option, such as when you forget your WordPress username and email address and get locked out of your admin account.

First, you will need to log in to your web hosting and open CPanel. Once you’re inside CPanel, go ahead and navigate to  ‘phpMyAdmin.’

This will launch phpMyAdmin in a new browser tab. You will need to select your WordPress database if it is not already selected. You will now see your WordPress database tables. By default, WordPress database tables use wp_ as a prefix before each table’s name. It is possible that you may have changed the database prefix to something else.

You need to click on the wp_users table on the left-hand side. Then, you should click ‘Edit’ next to the username that you wish to change. Now, you will be able to type the new username you wish to use into the user_login field. When you are done, you’ll need to click the ‘Go’ button at the bottom of the screen to save the new username.

That’s all! Now, you should be able to log in to your dashboard with your new username.

Keeping Your WordPress Blog Secure: A Beginner’s Guide

In The Sky IT Posted on by

WordPress powers over 40% of the web, making it a popular target for hackers and security threats. While the platform itself is secure, neglecting basic security practices can leave your site vulnerable. The good news? You don’t need to be a tech expert to protect your blog. In this guide, we’ll cover simple step you can take to keep your WordPress site safe from common threats. Whether you’re a beginner or just looking to tighten your defenses, these tips will help you secure your blog with confidence.

Basics of WordPress Security

Why Website Security is Important

A hacked WordPress website can cause serious damage to your business’s revenue and reputation. Hackers can steal user information and passwords, install malicious software, and even distribute malware to your users.
Worst, you may find yourself paying ransomware to hackers just to regain access to your website. Every day, Google warns 12-14 million users that a website they are trying to visit may contain malware or steal information.
Furthermore, Google blacklists around 10,000+ websites each day for malware or phishing.
Just as business owners with a physical location are responsible for safeguarding their property, online business owners need to pay extra attention to their WordPress security.

Keep WordPress Updated

WordPress is open-source software and is regularly maintained and updated. By default, WordPress automatically installs minor updates. For major releases, you need to manually initiate the update.
WordPress also comes with thousands of plugins and themes that you can install on your website. These plugins and themes are maintained by third-party developers, which regularly release updates as well.
These WordPress updates are crucial for the security and stability of your WordPress site. You need to make sure that your WordPress core, plugins, and theme are up to date.

Use Strong Passwords & User Permissions

The most common WordPress hacking attempts use stolen passwords. However, you can make that difficult by using stronger, unique passwords for your website.
We are not just talking about the WordPress admin area. Remember to create strong passwords for your FTP accounts, databases, WordPress hosting accounts, and custom email addresses that use your site’s domain name.
Many beginners don’t like using strong passwords because they are hard to remember. The good thing is that you don’t need to remember passwords anymore because you can just use a password manager.

Another way to reduce the risk is to not give anyone access to your WordPress admin account unless you absolutely have to.
If you have a large team or guest authors, then make sure that you understand user roles and capabilities in WordPress before you add new user accounts and authors to your WordPress site.

WordPress Security in a Few Steps

1. Install a Backup Solution

Backups are your last defense against any WordPress attack. Remember, nothing is 100% secure. If government websites can be hacked, then so can yours.
Backups allow you to quickly restore your WordPress site in case something bad was to happen.

There are many free and paid WordPress backup plugins that you can use. The most important thing you need to know when it comes to backups is that you must regularly save full-site backups to a remote location (not your hosting account). We recommend storing it on a cloud service like Amazon or Dropbox, or in private cloud like Stash.

Based on how frequently you update your website, the ideal setting might be either once a day or real-time backups.
Thankfully this can be easily done by using plugins like Duplicator or BlogVault. They are both reliable and most importantly easy to use.

For more about WordPress Plugins, check out handy guide to some of the most useful ones HERE.

2. Install a Good WordPress Security Plugin

After backups, the next thing you need to do is set up a way to keep track of all the activity happening on your website. This includes file integrity monitoring, failed login attempts, SQL injection attempts and lots more. Thankfully, you can easily take care of this by installing a security plugin. There are plenty available but the one we recommend is WordFence because it is both capable and simple. You don’t nee to be a network engineer to configure it.

Once you have installed your new plugin, you should head over to it’s Dashboard page see if the plugin found any immediate issues with your WordPress site. Whilst here you can click around and get comfortable with your new plugin’s capabilities. The default settings should work well for most websites, but if you are feeling confident, you can go ahead and tweak some settings to see what happens. You can always change things back later on.

one thing we recommend you customise right now is the email alerts feature. By default, you will receive a lot of email alerts that can clutter your inbox so go ahead and change these settings to whatever level of alert you feel comfortable with. We recommend enabling alerts only for key actions you wish to be notified about, such as plugin changes and new user registrations.

3. Enable a Web Application Firewall (WAF)

The next thing you should do is enable a Web Application Firewall to block malicious traffic before it even reaches your website. Firewall software works on one of two levels:

  • A DNS-level website firewall routes your website traffic through a proxy server hosted by the software vendor. This server screens out known malicious traffic sources and passes on the valid traffic to your website.
  • An application-level firewall examines the traffic once it reaches your site but before loading most WordPress scripts. This method is not as efficient as the DNS-level firewall in reducing the server load.

A DNS-level Firewall is the preferred option. Fortunately for you, you just installed WordFence, which includes a DNS-level WAF with a handy learning mode which allows it to partially configure itself based on your average content and traffic.

4. Make Sure Your Site is Using HTTPS

SSL (Secure Sockets Layer) is a protocol that encrypts data transfer between your website and the user’s browser. This encryption makes it harder for someone to steal your data. Once you enable SSL, your website address will use HTTPS instead of HTTP.

SSL certificates are typically issued by certificate authorities, and their prices start from $80 to hundreds of dollars each year. Due to added cost, most website owners in the past opted to keep using the insecure protocol. To fix this, a non-profit organization called Let’s Encrypt decided to offer free SSL Certificates to website owners. Their project is supported by Google Chrome, Facebook, Mozilla, and many more companies.

Many hosting companies now offer a free, or very cheap, SSL certificate for use with WordPress websites. If your hosting company does not offer one, then you can purchase an SSL certificate from Domain.com. They have the best and most reliable SSL deals on the market. The certificate comes with a $10,000 security warranty and a TrustLogo security seal.

5. Change the Default Admin Username

In the old days, the default WordPress admin username was ‘admin’. Since usernames make up half of the login credentials, this made it easier for hackers to do brute-force attacks. Thankfully, WordPress has since changed this and now requires you to select a custom username at the time of installing WordPress.

However, some 1-click WordPress installers still set the default admin username to ‘admin’. If you notice that to be the case, then it’s probably a good idea to switch your web hosting. Since WordPress doesn’t allow you to change usernames by default, there are three methods you can use to change the username.

  1. Create a new admin username and delete the old one.
  2. Use the Username Changer plugin
  3. Update username from phpMyAdmin

You can find our detailed guide to how to change your WordPress username HERE

6. Disable File Editing

WordPress comes with a built-in code editor that allows you to edit your theme and plugin files right from your WordPress admin area. In the wrong hands, this feature can be a security risk, which is why we recommend turning it off. You can easily do this by adding the following code to your
wp-config.php file or with a code snippet plugin like WPCode.

1
2
// Disallow file edit
define( 'DISALLOW_FILE_EDIT', true );
We show you how to do this step by step in our guide on how to disable file editing HERE.

7. Disable PHP File Execution

Another way to harden your WordPress security is by disabling PHP file execution in directories where it’s not needed, such as /wp-content/uploads/.
You can do this by opening a text editor like Notepad and pasting this code:

1
2
3
<Files *.php>
deny from all
</Files>

Next, you need to save this file as .htaccess and upload it to the /wp-content/uploads/ folder on your website using an FTP client.

For a more detailed explanation, see our guide on how to disable PHP execution, HERE.

8. Limit Login Attempts

By default, WordPress allows users to try to log in as many times as they want. This leaves your WordPress site vulnerable to brute-force attacks. This is where hackers try to crack passwords by trying to log in over and over again with different combinations of characters in the hope of hitting the correct password by guesswork. This can be easily fixed by limiting the failed login attempts a user can make.

Some versions of a Web Application Firewall, include this feature. If you have chosen one of these, then this is automatically taken care of. However, if you don’t have a firewall set up. Or you chose a WAF which doesn’t have this facility,  then you can use a separate plugin to limit login attempts. We’re using Loginizer for this example:

  • First, you need to install and activate the free Loginizer plugin.
  • Once activated and Configured, the plugin will start to limit the number of login attempts users can take.

The default settings will work for most websites. However, you can customize them by visiting the Loginizer Security tab in the sidebar. This plugin will also allow you to enable other advanced login features like 2 Factor Authentication and Single Sign-On.

9. Disable XML-RPC in WordPress

XML-RPC is a core WordPress API that helps connect your WordPress site with web and mobile apps. It has been enabled by default since WordPress 3.5. However, because of its powerful nature, XML-RPC can significantly amplify brute-force attacks. For example, if a hacker traditionally wanted to try 500 different passwords on your website, they would have to make 500 separate login attempts.

But with XML-RPC, a hacker can use the system.multicall function to try thousands of passwords with say 20 or 50 requests. This is why if you are not using XML-RPC, then we recommend that you disable it. There are 3 ways to disable XML-RPC in WordPress, and we take you through them in our details article on the subject which you can find HERE.

10. Hire Professionals Instead

As a busy small business owner, you may not have time to monitor your website security and protect it from vulnerabilities. So, to ease your mind and lighten your workload, you can hire a managed service provider to monitor and maintain your WordPress site for you 24/7.

In The Sky IT offers comprehensive WordPress website maintenance at an affordable price. It includes security monitoring, routine cloud backups, WordPress updates, uptime monitoring, and much more. Find out more HERE.

So You’ve Installed WordPress, Now What?

In The Sky IT Posted on by

Congratulations on installing WordPress! You’ve taken the first step towards creating your own website or blog. Now you’re staring at the WordPress dashboard for the first time and feeling a little overwhelmed. Don’t panic! I’m going to walk you through the essential steps to configure your new WordPress site, even if you’re a complete beginner.

1. Familiarize Yourself with the Dashboard

When you log into WordPress, you’ll land on the Dashboard. Think of it as your website’s control center. Here’s you’ll find a sidebar with a set of options:

  • Posts: Where you create and manage blog articles.
  • Pages: Used for static content like “About Us” or “Contact” pages.
  • Appearance: Customize the look of your site.
  • Plugins: Add new features without coding.
  • Settings: Configure site-wide options.

And a lot of blank space in the middle under a welcome message. As you customise your site and add content, the blank space will fill up with useful data about your site. You’ll come here to find information about security threats, traffic, software updates and lots more.

Spend a few minutes clicking around to get comfortable.

2. Set Up Basic Site Settings

Head to Settings > General to configure key details:

  • Site Title: Your website’s name.
  • Tagline: A short description or slogan.
  • URL: Ensure your website address (URL) is correct.
  • Timezone: Set this to your local time for accurate post scheduling.

Click Save Changes when you’re done.

3. Choose a Theme

Your theme controls your website’s overall look and feel. Go to Appearance > Themes > Add New to browse free themes.

  • Use the search bar to find themes suited for blogs, portfolios, or businesses.
  • Click Preview to see how a theme looks.
  • Click Install and then Activate to apply your chosen theme.

4. Customize Your Theme

Go to Appearance > Customize to tweak your theme’s settings:

  • Site Identity: Upload a logo and adjust your tagline.
  • Colors & Fonts: Adjust to match your brand.
  • Homepage Settings: Choose between a static homepage or your latest posts.

Make changes and click Publish to save.

5. Create Your First Pages

Go to Pages > Add New to create important pages:

  • About: Share your story.
  • Contact: Include a form so visitors can reach you.
  • Privacy Policy: A must for legal compliance.

Add titles, content, and click Publish when ready.

6. Set Up Navigation Menus

Organize your site’s structure via Appearance > Menus:

  • Click Create a New Menu.
  • Add your pages (About, Contact, Blog, etc.).
  • Drag and drop to reorder.
  • Choose where the menu appears (usually “Primary Menu”).

Click Save Menu to apply changes.

7. Adjust Reading Settings

Go to Settings > Reading:

  • Homepage Displays: Choose a static page or your latest posts.
  • Blog Pages Show At Most: Control how many posts display per page.

Click Save Changes after adjustments.

8. Start Blogging!

You’re ready to create content. Go to Posts > Add New:

  • Add a catchy title.
  • Write your content in the editor.
  • Add images via the “Add Media” button.
  • Choose categories and tags to organize your posts.

Click Publish when you’re ready to go live.