WordPress provides XML-RPC functionality for remote publishing and content management. This API allows external applications to interact with WordPress for creating, editing, and managing content.

Architecture

Core Components

Source File: wp-includes/class-wp-xmlrpc-server.php

The XML-RPC system consists of:

1. wp_xmlrpc_server – Main server class extending IXR_Server
2. Endpoint: xmlrpc.php in the WordPress root directory
3. IXR Library: Internal XML-RPC handling library

Class Hierarchy

IXR_Server
    └── wp_xmlrpc_server

Properties

API Categories

WordPress API (wp.*)

Modern WordPress-specific methods for comprehensive content management:

Blogger API (blogger.*)

Legacy Blogger-compatible methods:

MetaWeblog API (metaWeblog.*)

MetaWeblog protocol with MovableType extensions:

MovableType API (mt.*)

MovableType-compatible methods:

Pingback (pingback.*)

Pingback protocol implementation:

Demo Methods

Test methods for verifying connectivity:

Authentication

Login Process

1. Client sends username/password with each request
2. login() method authenticates via wp_authenticate()
3. On success, sets current user via wp_set_current_user()
4. On failure, returns IXR_Error(403)

Security Features

• Rate Limiting: Failed auth flags $auth_failed to prevent brute force
• Capability Checks: Each method verifies user capabilities
• Sensitive Parameter Handling: Uses #[SensitiveParameter] attribute

public function login(
    $username,
    #[SensitiveParameter]
    $password
) { ... }

Enabling/Disabling XML-RPC

Check Status

// XML-RPC is enabled by default since WordPress 3.5.0

Disable Authenticated Methods

// Disables methods requiring authentication (not pingbacks)
add_filter( 'xmlrpc_enabled', '__return_false' );

Remove Specific Methods

add_filter( 'xmlrpc_methods', function( $methods ) {
    unset( $methods['pingback.ping'] );
    return $methods;
});

Blog Options

Available options accessible via wp.getOptions/wp.setOptions:

Read-Only Options

Writable Options

Data Structures

Post Structure (wp.* methods)

array(
    'post_id'           => '123',
    'post_title'        => 'Title',
    'post_date'         => IXR_Date,
    'post_date_gmt'     => IXR_Date,
    'post_modified'     => IXR_Date,
    'post_modified_gmt' => IXR_Date,
    'post_status'       => 'publish',
    'post_type'         => 'post',
    'post_name'         => 'slug',
    'post_author'       => '1',
    'post_password'     => '',
    'post_excerpt'      => '',
    'post_content'      => 'Content...',
    'post_parent'       => '0',
    'post_mime_type'    => '',
    'link'              => 'https://...',
    'guid'              => 'https://...',
    'menu_order'        => 0,
    'comment_status'    => 'open',
    'ping_status'       => 'open',
    'sticky'            => false,
    'post_thumbnail'    => array(...),
    'post_format'       => 'standard',
    'terms'             => array(...),
    'custom_fields'     => array(...),
    'enclosure'         => array(...),
)

Term Structure

array(
    'term_id'          => '5',
    'name'             => 'Category Name',
    'slug'             => 'category-name',
    'term_group'       => '0',
    'term_taxonomy_id' => '5',
    'taxonomy'         => 'category',
    'description'      => '',
    'parent'           => '0',
    'count'            => 10,
    'custom_fields'    => array(...),
)

User Structure

array(
    'user_id'      => '1',
    'username'     => 'admin',
    'first_name'   => 'John',
    'last_name'    => 'Doe',
    'registered'   => IXR_Date,
    'bio'          => '',
    'email'        => '[email protected]',
    'nickname'     => 'John',
    'nicename'     => 'john',
    'url'          => 'https://...',
    'display_name' => 'John Doe',
    'roles'        => array('administrator'),
)

Comment Structure

array(
    'date_created_gmt' => IXR_Date,
    'user_id'          => '0',
    'comment_id'       => '1',
    'parent'           => '0',
    'status'           => 'approve',
    'content'          => 'Comment text...',
    'link'             => 'https://...',
    'post_id'          => '123',
    'post_title'       => 'Post Title',
    'author'           => 'Commenter',
    'author_url'       => '',
    'author_email'     => '[email protected]',
    'author_ip'        => '192.168.1.1',
    'type'             => '',
)

Error Codes

Pingback-Specific Errors

Making XML-RPC Requests

Request Format

<?xml version="1.0"?>
<methodCall>
    <methodName>wp.getPosts</methodName>
    <params>
        <param><value><int>1</int></value></param>
        <param><value><string>username</string></value></param>
        <param><value><string>password</string></value></param>
    </params>
</methodCall>

PHP Example

$client = new IXR_Client( 'https://example.com/xmlrpc.php' );
$client->query( 'wp.getPosts', 1, 'username', 'password', array(
    'post_type' => 'post',
    'number'    => 10,
));
$posts = $client->getResponse();

Security Considerations

1. Always use HTTPS for XML-RPC connections
2. Consider Application Passwords instead of main credentials
3. Disable if not needed via xmlrpc_enabled filter
4. Monitor for abuse – common target for brute force attacks
5. Use firewall rules to restrict XML-RPC access if needed

Related Files

• wp-includes/class-IXR.php – IXR library
• xmlrpc.php – Entry point
• wp-includes/functions.php – Helper functions (xmlrpc_getposttitle, etc.)