XML-RPC is a protocol that lets external applications communicate with your WordPress site remotely — publishing a post from a mobile app, for instance, without logging into the dashboard directly.
It’s been part of WordPress for a long time, predating the newer REST API that now handles many of the same tasks in a more modern way.
Why It’s Often Mentioned in a Security Context
XML-RPC has historically been targeted by attackers attempting brute-force login attempts, since a single request to this file can effectively try many password combinations at once. Because of this, many security plugins offer an option to disable it entirely.
Should You Disable It?
If you don’t use any app or service that specifically relies on XML-RPC — like certain older mobile publishing apps or the Jetpack plugin, which still uses it for some features — disabling it can reduce one avenue of attack without affecting your everyday site management.
If you’re unsure whether something you use depends on it, it’s worth checking before turning it off completely.