{"id":990,"date":"2026-07-21T20:59:19","date_gmt":"2026-07-21T20:59:19","guid":{"rendered":"https:\/\/www.ahosting.net\/blog\/?p=990"},"modified":"2026-07-22T09:34:41","modified_gmt":"2026-07-22T09:34:41","slug":"stop-xml-rpc-bot-flood","status":"publish","type":"post","link":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/","title":{"rendered":"How to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)"},"content":{"rendered":"\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"How do I stop an XML-RPC bot flood without breaking Jetpack in 2026?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Specifically, allowlist Jetpack's Automattic IP ranges first, then deny xmlrpc.php for everyone else in .htaccess so the request is refused at the web server before WordPress loads. In our July 2026 server logs, Jetpack accounted for 47 percent of all XML-RPC traffic, so a blanket deny would have broken nearly half the observed requests. The full allowlist syntax appears in the numbered fix section.\"}},{\"@type\":\"Question\",\"name\":\"Is the system.multicall XML-RPC amplification attack still a threat in 2026?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Notably, no. WordPress core patched it in version 4.4, released December 2015, via Trac ticket 34336: once one authentication attempt inside a system.multicall batch fails, every remaining attempt in that batch fails too. Much of the advice ranking for this problem still describes the pre-4.4 mechanic. The 2026 problem is sequential request volume, not batched credential amplification.\"}},{\"@type\":\"Question\",\"name\":\"Why does my site show a 503 error instead of a 508 during an XML-RPC flood?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Specifically, LiteSpeed queues requests when your entry process ceiling is reached rather than rejecting them instantly, so the visitor waits and then receives a 503 only if the queue window expires first. Apache-based hosts surface the same underlying concurrency event as a literal 508 page. Both errors mean the same thing: no free PHP worker.\"}},{\"@type\":\"Question\",\"name\":\"How many PHP workers does an XML-RPC flood consume on AHosting shared hosting plans?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Specifically, one uncacheable PHP worker per request that reaches WordPress. In our July 2026 measurement window the busiest account sustained 59 XML-RPC POSTs per minute against a 15 entry process ceiling, the AHosting Bronze allocation. Consequently the flood alone can saturate the plan's entire concurrency allocation before a single real visitor is served.\"}},{\"@type\":\"Question\",\"name\":\"Should I block xmlrpc.php with a plugin or with .htaccess on AHosting WordPress hosting?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Therefore use .htaccess. A PHP-based security plugin still boots WordPress to decide the request should be denied, which consumes the entry process you were trying to protect. A web server rule refuses the request before PHP ever loads, so the worker is never allocated. WordPress core developers state the same thing: denial of service against xmlrpc.php needs handling at the server level.\"}},{\"@type\":\"Question\",\"name\":\"Does blocking xmlrpc.php at Cloudflare protect the plain HTTP port 80 path too?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Importantly, not necessarily. One account in our July 2026 logs recorded 2,296 XML-RPC POSTs on port 80 alongside 964 on port 443. Consequently an edge rule scoped only to HTTPS traffic can leave the plain HTTP path fully open. Always verify the block returns 403 on both schemes.\"}},{\"@type\":\"Question\",\"name\":\"What percentage of XML-RPC bot requests hit a file that does not even exist?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Interestingly, 56 percent in our July 2026 sample: 13,566 of 23,993 requests returned 404 because xmlrpc.php had already been removed or blocked on those accounts. In other words most of this traffic is indiscriminate scanning rather than targeted attack, and the accounts that matter are the 10,025 that returned 200.\"}},{\"@type\":\"Question\",\"name\":\"When should I disable XML-RPC entirely versus allowlisting Jetpack on a WordPress site?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Specifically, deny it outright when nothing on the site uses XML-RPC: no Jetpack, no WordPress mobile app publishing, no remote editor, and no pingbacks you rely on. Allowlist instead when Jetpack handles your stats, backups, or Publicize. The comparison table in this guide names the trade-off for each method.\"}},{\"@type\":\"Question\",\"name\":\"How do I confirm an XML-RPC block is actually working on my WordPress site?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Specifically, request the file and confirm the response is 403 rather than 200 or 405. Then grep your raw access log for xmlrpc.php and confirm new entries show 403 status codes. Additionally, watch your cPanel entry process graph and cache hit ratio recover over the following hours.\"}},{\"@type\":\"Question\",\"name\":\"Does an XML-RPC bot flood hurt cache hit ratio on AHosting LiteSpeed hosting in 2026?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Fundamentally, yes. Every XML-RPC POST is uncacheable by definition, so it bypasses LiteSpeed Cache on AHosting entirely and executes PHP. As a result your cached-to-uncached ratio collapses in reporting, and the workers those requests occupy are unavailable to visitors whose pages would otherwise have been generated quickly.\"}}]}<\/script>\n\n\n<div class=\"wp-block-aioseo-table-of-contents\"><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-an-xml-rpc-bot-flood-actually-costs-your-wordpress-site-5\">What an XML-RPC Bot Flood Actually Costs Your WordPress Site<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-the-xml-rpc-bot-flood-symptom-is-usually-a-503-not-a-508-8\">Why the XML-RPC Bot Flood Symptom Is Usually a 503, Not a 508<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-three-symptoms-that-identify-an-xml-rpc-bot-flood-11\">The Three Symptoms That Identify an XML-RPC Bot Flood<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-23993-real-xml-rpc-requests-look-like-in-2026-14\">What 23,993 Real XML-RPC Requests Look Like in 2026<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-nearly-half-of-xml-rpc-traffic-is-jetpack-not-an-attack-18\">Nearly Half of XML-RPC Traffic Is Jetpack, Not an Attack<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-port-80-gap-that-edge-only-blocking-misses-22\">The Port 80 Gap That Edge-Only Blocking Misses<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-the-advice-you-will-find-is-describing-a-2015-vulnerability-25\">Why the Advice You Will Find Is Describing a 2015 Vulnerability<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-where-wordpress-core-says-this-problem-belongs-30\">Where WordPress Core Says This Problem Belongs<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-how-to-stop-an-xml-rpc-bot-flood-in-five-steps-33\">How to Stop an XML-RPC Bot Flood in Five Steps<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-first-step-confirm-the-flood-exists-in-your-raw-access-log-35\">First Step: Confirm the Flood Exists in Your Raw Access Log<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-second-step-split-your-traffic-into-jetpack-and-everything-else-39\">Second Step: Split Your Traffic Into Jetpack and Everything Else<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-third-step-choose-your-blocking-method-43\">Third Step: Choose Your Blocking Method<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-fourth-step-apply-the-rule-in-htaccess-47\">Fourth Step: Apply the Rule in .htaccess<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-fifth-step-verify-the-block-on-both-http-and-https-53\">Fifth Step: Verify the Block on Both HTTP and HTTPS<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-estimate-your-own-xml-rpc-bot-flood-worker-cost-57\">Estimate Your Own XML-RPC Bot Flood Worker Cost<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-when-blocking-is-not-enough-61\">When Blocking Is Not Enough<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-your-xml-rpc-bot-flood-checklist-65\">Your XML-RPC Bot Flood Checklist<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-xml-rpc-bot-flood\">Frequently Asked Questions: Stopping an XML-RPC Bot Flood<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#faq-stop-without-breaking-jetpack\">How do I stop an XML-RPC bot flood without breaking Jetpack in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-multicall-still-threat\">Is the system.multicall XML-RPC amplification attack still a threat in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-503-not-508\">Why does my site show a 503 error instead of a 508 during an XML-RPC flood?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-workers-consumed-ahosting\">How many PHP workers does an XML-RPC flood consume on AHosting shared hosting plans?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-plugin-vs-htaccess-ahosting\">Should I block xmlrpc.php with a plugin or with .htaccess on AHosting WordPress hosting?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-cloudflare-port-80\">Does blocking xmlrpc.php at Cloudflare protect the plain HTTP port 80 path too?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-404-share\">What percentage of XML-RPC bot requests hit a file that does not even exist?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-disable-vs-allowlist\">When should I disable XML-RPC entirely versus allowlisting Jetpack on a WordPress site?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-confirm-block-working\">How do I confirm an XML-RPC block is actually working on my WordPress site?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-cache-hit-ratio-2026\">Does an XML-RPC bot flood hurt cache hit ratio on AHosting LiteSpeed hosting in 2026?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n<div class=\"ah-tldr\">\n  <span class=\"ah-tldr-badge\">TL;DR<\/span>\n  <p>To stop an XML-RPC bot flood, allowlist Jetpack first, then deny xmlrpc.php in .htaccess so LiteSpeed refuses the request before WordPress loads and no PHP worker is consumed.<\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">An XML-RPC bot flood is the most expensive WordPress problem that never shows up on an uptime monitor. Your site responds. Your homepage loads. Yet your cache hit ratio quietly collapses, your entry process graph pegs at its ceiling, and real visitors start seeing errors during exactly the minutes you care about most. Meanwhile the traffic responsible is invisible in analytics, because bots do not fire JavaScript.<\/p>\n\n\n\n<figure class=\"wp-block-audio\"><audio controls src=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/Stopping_Invisible_WordPress_XML-RPC_Bot_Floods.m4a\"><\/audio><figcaption class=\"wp-element-caption\">Listen: why 47% of your XML-RPC traffic may be Jetpack, and how to block the rest.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Furthermore, most of the fix advice you will find is describing an attack that WordPress patched over a decade ago. This guide is built on 23,993 XML-RPC requests captured across roughly 200 WordPress accounts on a single AHosting shared server during one 18-hour window in July 2026 \u2014 what the traffic actually looks like now, what it costs in PHP workers, and the one trap that turns the standard fix into a self-inflicted outage.<\/p>\n\n\n\n<h2 id=\"aioseo-what-an-xml-rpc-bot-flood-actually-costs-your-wordpress-site-5\" class=\"wp-block-heading\">What an XML-RPC Bot Flood Actually Costs Your WordPress Site<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An XML-RPC bot flood costs you one uncacheable PHP worker per request. That single sentence explains every downstream symptom. Specifically, <code>xmlrpc.php<\/code> is a POST endpoint that no cache layer can serve from storage, so every request that reaches it bypasses LiteSpeed Cache entirely and executes PHP against your account&#8217;s concurrency ceiling.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore the arithmetic is unforgiving. In our July 2026 measurement window, the busiest single account sustained <strong>59 XML-RPC POSTs per minute<\/strong> for a continuous fifteen-minute stretch. That account runs on a plan with <strong>15 entry processes<\/strong>. In other words, the flood alone was requesting nearly four times the account&#8217;s entire concurrent capacity every minute, before a single genuine visitor was counted.<\/p>\n\n\n\n<h3 id=\"aioseo-why-the-xml-rpc-bot-flood-symptom-is-usually-a-503-not-a-508-8\" class=\"wp-block-heading\">Why the XML-RPC Bot Flood Symptom Is Usually a 503, Not a 508<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, the error you actually see depends on your web server. On Apache-based cPanel hosts, hitting the entry process ceiling produces the familiar 508 Resource Limit Reached page. On LiteSpeed, which is what AHosting runs, requests are queued first \u2014 so the visitor experiences a slowdown and only receives a 503 if the queue window expires before a worker frees up.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consequently, if you have been searching for why your resource graphs are pegged but you never see a literal 508 page, this is the answer. Our sample logged <strong>50 genuine 503 responses<\/strong> against XML-RPC endpoints during the window. For the full mechanics of that ceiling, our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/508-resource-limit-reached-wordpress\/\">what entry process limits really mean when you hit a 508 resource limit<\/a> covers how concurrency is calculated and why page generation time is the hidden multiplier.<\/p>\n\n\n\n<h3 id=\"aioseo-the-three-symptoms-that-identify-an-xml-rpc-bot-flood-11\" class=\"wp-block-heading\">The Three Symptoms That Identify an XML-RPC Bot Flood<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, the pattern is recognizable before you ever open a log file. Firstly, your cache hit ratio drops sharply while total traffic appears flat or even low in analytics. Secondly, your cPanel entry process graph shows sustained plateaus rather than the brief spikes normal traffic produces. Thirdly, <code>wp-admin<\/code> becomes sluggish or briefly unreachable at moments when your public pages still load instantly, because cached pages need no worker while your admin session does.<\/p>\n\n\n\n<div class=\"ah-infographic\">\n  <svg viewBox=\"0 0 860 300\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Diagram comparing a cached visitor request that never reaches PHP with an XML-RPC POST that consumes a PHP worker against the entry process ceiling\">\n    <rect x=\"0\" y=\"0\" width=\"860\" height=\"300\" fill=\"#0f172a\" rx=\"10\"\/>\n    <text x=\"30\" y=\"42\" fill=\"#ffffff\" font-family=\"Arial, sans-serif\" font-size=\"21\" font-weight=\"bold\">Why one XML-RPC POST costs more than one visitor<\/text>\n    <rect x=\"30\" y=\"70\" width=\"180\" height=\"62\" fill=\"#1e293b\" stroke=\"#2563eb\" stroke-width=\"2\" rx=\"8\"\/>\n    <text x=\"120\" y=\"96\" fill=\"#ffffff\" font-family=\"Arial, sans-serif\" font-size=\"15\" text-anchor=\"middle\">Cached visitor<\/text>\n    <text x=\"120\" y=\"118\" fill=\"#94a3b8\" font-family=\"Arial, sans-serif\" font-size=\"13\" text-anchor=\"middle\">GET \/page\/<\/text>\n    <rect x=\"250\" y=\"70\" width=\"180\" height=\"62\" fill=\"#1e293b\" stroke=\"#2563eb\" stroke-width=\"2\" rx=\"8\"\/>\n    <text x=\"340\" y=\"96\" fill=\"#ffffff\" font-family=\"Arial, sans-serif\" font-size=\"15\" text-anchor=\"middle\">LiteSpeed Cache<\/text>\n    <text x=\"340\" y=\"118\" fill=\"#4ade80\" font-family=\"Arial, sans-serif\" font-size=\"13\" text-anchor=\"middle\">served from cache<\/text>\n    <rect x=\"470\" y=\"70\" width=\"180\" height=\"62\" fill=\"#1e293b\" stroke=\"#334155\" stroke-width=\"2\" rx=\"8\"\/>\n    <text x=\"560\" y=\"96\" fill=\"#64748b\" font-family=\"Arial, sans-serif\" font-size=\"15\" text-anchor=\"middle\">PHP worker<\/text>\n    <text x=\"560\" y=\"118\" fill=\"#4ade80\" font-family=\"Arial, sans-serif\" font-size=\"13\" text-anchor=\"middle\">not used<\/text>\n    <line x1=\"210\" y1=\"101\" x2=\"248\" y2=\"101\" stroke=\"#2563eb\" stroke-width=\"2\"\/>\n    <line x1=\"430\" y1=\"101\" x2=\"468\" y2=\"101\" stroke=\"#334155\" stroke-width=\"2\" stroke-dasharray=\"5,4\"\/>\n    <rect x=\"30\" y=\"170\" width=\"180\" height=\"62\" fill=\"#1e293b\" stroke=\"#f97316\" stroke-width=\"2\" rx=\"8\"\/>\n    <text x=\"120\" y=\"196\" fill=\"#ffffff\" font-family=\"Arial, sans-serif\" font-size=\"15\" text-anchor=\"middle\">Bot request<\/text>\n    <text x=\"120\" y=\"218\" fill=\"#94a3b8\" font-family=\"Arial, sans-serif\" font-size=\"13\" text-anchor=\"middle\">POST \/xmlrpc.php<\/text>\n    <rect x=\"250\" y=\"170\" width=\"180\" height=\"62\" fill=\"#1e293b\" stroke=\"#f97316\" stroke-width=\"2\" rx=\"8\"\/>\n    <text x=\"340\" y=\"196\" fill=\"#ffffff\" font-family=\"Arial, sans-serif\" font-size=\"15\" text-anchor=\"middle\">Cache bypassed<\/text>\n    <text x=\"340\" y=\"218\" fill=\"#f97316\" font-family=\"Arial, sans-serif\" font-size=\"13\" text-anchor=\"middle\">POST is uncacheable<\/text>\n    <rect x=\"470\" y=\"170\" width=\"180\" height=\"62\" fill=\"#1e293b\" stroke=\"#ef4444\" stroke-width=\"2\" rx=\"8\"\/>\n    <text x=\"560\" y=\"196\" fill=\"#ffffff\" font-family=\"Arial, sans-serif\" font-size=\"15\" text-anchor=\"middle\">PHP worker<\/text>\n    <text x=\"560\" y=\"218\" fill=\"#ef4444\" font-family=\"Arial, sans-serif\" font-size=\"13\" text-anchor=\"middle\">1 of 15 consumed<\/text>\n    <line x1=\"210\" y1=\"201\" x2=\"248\" y2=\"201\" stroke=\"#f97316\" stroke-width=\"2\"\/>\n    <line x1=\"430\" y1=\"201\" x2=\"468\" y2=\"201\" stroke=\"#f97316\" stroke-width=\"2\"\/>\n    <rect x=\"680\" y=\"150\" width=\"150\" height=\"102\" fill=\"#7f1d1d\" stroke=\"#ef4444\" stroke-width=\"2\" rx=\"8\"\/>\n    <text x=\"755\" y=\"184\" fill=\"#ffffff\" font-family=\"Arial, sans-serif\" font-size=\"28\" font-weight=\"bold\" text-anchor=\"middle\">59\/min<\/text>\n    <text x=\"755\" y=\"208\" fill=\"#fecaca\" font-family=\"Arial, sans-serif\" font-size=\"13\" text-anchor=\"middle\">peak observed<\/text>\n    <text x=\"755\" y=\"230\" fill=\"#fecaca\" font-family=\"Arial, sans-serif\" font-size=\"13\" text-anchor=\"middle\">vs 15 EP ceiling<\/text>\n    <text x=\"30\" y=\"278\" fill=\"#64748b\" font-family=\"Arial, sans-serif\" font-size=\"13\">AHosting shared server, 23,993 XML-RPC requests measured over 18 hours, July 2026<\/text>\n  <\/svg>\n<\/div>\n\n\n\n<h2 id=\"aioseo-what-23993-real-xml-rpc-requests-look-like-in-2026-14\" class=\"wp-block-heading\">What 23,993 Real XML-RPC Requests Look Like in 2026<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most published guidance on this topic reasons from a single incident report. In contrast, we measured every XML-RPC request arriving at one shared AHosting server across an 18-hour window on 20\u201321 July 2026 \u2014 roughly 200 WordPress accounts, no sampling. The response code distribution is the part nobody publishes, and it changes what the correct fix looks like.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Response<\/th><th>Count<\/th><th>Share<\/th><th>What it means<\/th><\/tr><\/thead><tbody><tr><td><strong>404 Not Found<\/strong><\/td><td>13,566<\/td><td>56.5%<\/td><td>File already removed or blocked \u2014 bots scanning blindly<\/td><\/tr><tr><td><strong>200 OK<\/strong><\/td><td>10,025<\/td><td>41.8%<\/td><td>WordPress loaded and a PHP worker was consumed<\/td><\/tr><tr><td>301 Redirect<\/td><td>535<\/td><td>2.2%<\/td><td>Scheme or host redirect before processing<\/td><\/tr><tr><td><strong>503 Unavailable<\/strong><\/td><td>50<\/td><td>0.2%<\/td><td>Queue window expired \u2014 no worker available<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Interestingly, the 404 majority reframes the whole problem. Most of this traffic is indiscriminate scanning against sites that already removed the file, which means the bots are not selecting targets intelligently. As a result, the accounts that genuinely matter are the ones behind those 10,025 successful responses \u2014 each one a PHP worker allocated to answer a bot.<\/p>\n\n\n\n<h3 id=\"aioseo-nearly-half-of-xml-rpc-traffic-is-jetpack-not-an-attack-18\" class=\"wp-block-heading\">Nearly Half of XML-RPC Traffic Is Jetpack, Not an Attack<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the finding that should stop you before you paste any blocking rule. Of the 23,993 requests we captured, <strong>11,388 \u2014 roughly 47 percent \u2014 carried Jetpack or WordPress.com user agents<\/strong>. Jetpack uses XML-RPC as its transport to communicate with WordPress.com, and it has done so for years.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consequently, the advice to simply deny <code>xmlrpc.php<\/code> would have broken nearly half of the observed traffic on this server \u2014 taking down Jetpack stats, backups, Publicize, and mobile app publishing for every affected customer. Notably, this caution is not new: the security researchers who originally disclosed XML-RPC brute-force amplification revised their own guidance for exactly this reason, recommending a full block only where Jetpack and similar plugins are not in use.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, the remaining traffic tells its own story. We recorded requests presenting Chrome, Firefox, and Opera browser user agents against an API-only endpoint that no browser ever posts to \u2014 spoofed headers, in other words. The top single source address issued 1,372 requests on its own, and the top twelve addresses together accounted for roughly 35 percent of all XML-RPC traffic on the server.<\/p>\n\n\n\n<h3 id=\"aioseo-the-port-80-gap-that-edge-only-blocking-misses-22\" class=\"wp-block-heading\">The Port 80 Gap That Edge-Only Blocking Misses<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, one account in our sample recorded <strong>2,296 XML-RPC POSTs on plain HTTP alongside 964 on HTTPS<\/strong>. That distribution matters enormously for anyone relying on a CDN or edge firewall rule scoped to HTTPS traffic, because it demonstrates the plain HTTP path can carry more than twice the volume of the encrypted one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore any block you apply must be verified on both schemes. In practice this is the single most common reason a site owner reports that &#8220;blocking did not work&#8221; \u2014 the rule was real, but it only ever covered one door.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"How To Stop an XML-RPC Bot Flood in WordPress (2026) - Without Breaking Jetpack\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube-nocookie.com\/embed\/kgHm2ig4N-E?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 id=\"aioseo-why-the-advice-you-will-find-is-describing-a-2015-vulnerability-25\" class=\"wp-block-heading\">Why the Advice You Will Find Is Describing a 2015 Vulnerability<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Search this problem and you will repeatedly read that a single POST can carry hundreds or thousands of password attempts through the <code>system.multicall<\/code> method, with amplification figures of 100x or 500x quoted confidently. That mechanic was real. It was also patched more than ten years ago.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, WordPress core addressed it in <strong>version 4.4, released December 2015<\/strong>, through <a href=\"https:\/\/core.trac.wordpress.org\/ticket\/34336\" target=\"_blank\" rel=\"noopener\">Trac ticket 34336, which disables XML-RPC system.multicall authenticated requests after the first authentication failure<\/a>. Once one credential attempt inside a batch fails, every remaining attempt in that batch fails with it. Consequently the amplification window closed for any site running WordPress 4.4 or newer, which in 2026 is effectively all of them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In contrast, what our logs show is the attack that replaced it: slow, distributed, sequential requests. No batching is required when you control enough source addresses to simply issue 23,993 individual POSTs. Ultimately this distinction matters because it changes the correct defense. Method-level filtering of <code>system.multicall<\/code> addresses a patched problem, whereas the 2026 problem is request volume reaching PHP at all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, it is worth knowing why the endpoint still exists at all. XML-RPC predates <a href=\"https:\/\/developer.wordpress.org\/rest-api\/\" target=\"_blank\" rel=\"noopener\">the WordPress REST API, which is now the supported interface for remote applications<\/a>. Modern integrations use the REST API, yet <code>xmlrpc.php<\/code> remains enabled by default for backward compatibility \u2014 which is precisely why it stays a standing target on sites that never knowingly use it.<\/p>\n\n\n\n<h3 id=\"aioseo-where-wordpress-core-says-this-problem-belongs-30\" class=\"wp-block-heading\">Where WordPress Core Says This Problem Belongs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, the WordPress project has been explicit about ownership of this issue. Responding to a request that core mitigate XML-RPC flooding, a core developer noted that a denial of service against <code>xmlrpc.php<\/code> is no different from one against the homepage or the login page, that preventing it falls <a href=\"https:\/\/core.trac.wordpress.org\/ticket\/47856\" target=\"_blank\" rel=\"noopener\">outside the scope of WordPress and needs to be handled at the server level<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is the entire argument for fixing this in your web server configuration rather than with a plugin, stated by the people who maintain the software. For the broader picture of which protections belong below the application layer, our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-hosting-security-2026-server-level-protection\/\">the server-level WordPress protection plugins cannot add<\/a> covers the same principle across firewalls and account isolation.<\/p>\n\n\n\n<h2 id=\"aioseo-how-to-stop-an-xml-rpc-bot-flood-in-five-steps-33\" class=\"wp-block-heading\">How to Stop an XML-RPC Bot Flood in Five Steps<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Deny <code>xmlrpc.php<\/code> in <code>.htaccess<\/code> so the web server returns 403 before WordPress loads \u2014 but allowlist Jetpack first if you use it. The steps below establish which case you are in before you change anything.<\/p>\n\n\n\n<h3 id=\"aioseo-first-step-confirm-the-flood-exists-in-your-raw-access-log-35\" class=\"wp-block-heading\">First Step: Confirm the Flood Exists in Your Raw Access Log<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Firstly, establish the problem is real rather than assumed. In cPanel, open <strong>Metrics \u2192 Raw Access<\/strong> and download the current log for your domain, or run the count directly over SSH if you have shell access.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">grep -c 'xmlrpc.php' ~\/access-logs\/yourdomain.com-ssl_log<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, a healthy site with Jetpack installed shows a steady low-hundreds count over a day. Anything in the thousands within a single log window is a flood. Additionally, run the same count against the non-SSL log, because the port 80 gap described above is easy to miss.<\/p>\n\n\n\n<h3 id=\"aioseo-second-step-split-your-traffic-into-jetpack-and-everything-else-39\" class=\"wp-block-heading\">Second Step: Split Your Traffic Into Jetpack and Everything Else<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Secondly, and this is the step almost every guide omits, find out how much of that traffic is your own. This single command answers the question that determines which fix you apply.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">grep 'xmlrpc.php' ~\/access-logs\/yourdomain.com-ssl_log | grep -c 'Jetpack'<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore compare that figure against your total. In our server-wide sample the Jetpack share was 47 percent. If your own ratio is similarly high and you actively use Jetpack features, proceed to the allowlist method. If it is near zero and nothing else on your site consumes XML-RPC, the full deny is simpler and stronger.<\/p>\n\n\n\n<h3 id=\"aioseo-third-step-choose-your-blocking-method-43\" class=\"wp-block-heading\">Third Step: Choose Your Blocking Method<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Thirdly, pick the method that matches what you found. The table below states the trade-off for each so the decision takes seconds rather than an afternoon of reading.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Method<\/th><th>Runs before PHP?<\/th><th>Jetpack survives?<\/th><th>Best for<\/th><\/tr><\/thead><tbody><tr><td><strong>.htaccess full deny<\/strong><\/td><td>Yes<\/td><td>No<\/td><td>Sites with zero XML-RPC dependency<\/td><\/tr><tr><td><strong>.htaccess with Jetpack allowlist<\/strong><\/td><td>Yes<\/td><td>Yes<\/td><td>Most sites \u2014 the recommended default<\/td><\/tr><tr><td>Security plugin block<\/td><td>No<\/td><td>Varies<\/td><td>Nothing \u2014 still consumes the worker<\/td><\/tr><tr><td>Rename or delete xmlrpc.php<\/td><td>Yes<\/td><td>No<\/td><td>Nothing \u2014 core updates restore it<\/td><\/tr><tr><td>Edge or CDN rule only<\/td><td>Yes<\/td><td>Configurable<\/td><td>Layered defense, never the sole block<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, the security plugin row is the one that surprises people. A PHP-based plugin must boot WordPress in order to decide the request should be refused, so the entry process you were trying to protect is consumed regardless. The block works; the resource saving does not materialize.<\/p>\n\n\n\n<h3 id=\"aioseo-fourth-step-apply-the-rule-in-htaccess-47\" class=\"wp-block-heading\">Fourth Step: Apply the Rule in .htaccess<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fourthly, edit the <code>.htaccess<\/code> file in your WordPress root directory. Place this block <strong>above<\/strong> the <code># BEGIN WordPress<\/code> marker so core updates never overwrite it. For a full deny, use the first form, which applies <a href=\"https:\/\/httpd.apache.org\/docs\/2.4\/howto\/access.html\" target=\"_blank\" rel=\"noopener\">the Apache 2.4 Require directive for unconditional access denial<\/a>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">&lt;Files \"xmlrpc.php\"&gt;\n  Require all denied\n&lt;\/Files&gt;<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively, to keep Jetpack working, allow Automattic&#8217;s ranges before denying everything else. Importantly, <a href=\"https:\/\/jetpack.com\/support\/how-to-add-jetpack-ips-allowlist\/\" target=\"_blank\" rel=\"noopener\">Jetpack publishes these ranges and warns that they are subject to change<\/a>, so verify the current list before deploying and re-check it periodically.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">&lt;Files \"xmlrpc.php\"&gt;\n  &lt;RequireAny&gt;\n    Require ip 122.248.245.244\n    Require ip 54.217.201.243\n    Require ip 54.232.116.4\n    Require ip 192.0.80.0\/20\n    Require ip 192.0.96.0\/20\n    Require ip 192.0.112.0\/20\n  &lt;\/RequireAny&gt;\n&lt;\/Files&gt;<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Importantly, <a href=\"https:\/\/docs.litespeedtech.com\/lsws\/configuration\/\" target=\"_blank\" rel=\"noopener\">LiteSpeed reads Apache-style .htaccess directives natively<\/a>, so this rule takes effect on AHosting <a href=\"https:\/\/www.ahosting.net\/wordpress-hosting.html\">WordPress hosting plans<\/a> without any server restart. Furthermore, because the rule is evaluated at the web server layer, a denied request never reaches PHP and never touches your entry process allocation.<\/p>\n\n\n\n<h3 id=\"aioseo-fifth-step-verify-the-block-on-both-http-and-https-53\" class=\"wp-block-heading\">Fifth Step: Verify the Block on Both HTTP and HTTPS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, prove it worked. Request the file on both schemes and confirm each returns 403 rather than 200 or 405.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">curl -s -o \/dev\/null -w \"%{http_code}\\n\" https:\/\/yourdomain.com\/xmlrpc.php\ncurl -s -o \/dev\/null -w \"%{http_code}\\n\" http:\/\/yourdomain.com\/xmlrpc.php<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Consequently both commands should print 403. Additionally, check your raw access log an hour later and confirm new <code>xmlrpc.php<\/code> entries now carry 403 status codes rather than 200. In practice your cache hit ratio and entry process graph should visibly recover within the same day.<\/p>\n\n\n\n<h2 id=\"aioseo-estimate-your-own-xml-rpc-bot-flood-worker-cost-57\" class=\"wp-block-heading\">Estimate Your Own XML-RPC Bot Flood Worker Cost<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, this calculator converts your raw log count into the concurrency figure that actually matters \u2014 how much of your plan&#8217;s entry process ceiling the flood is consuming. Enter the number you measured in the first step.<\/p>\n\n\n\n<style>\n.ahxrpc{background:#0f172a;border-radius:12px;padding:26px 24px;margin:26px 0;color:#fff;font-family:system-ui,-apple-system,'Segoe UI',sans-serif;}\n.ahxrpc h3{color:#fff;font-size:1.15rem;margin:0 0 6px;font-weight:700;}\n.ahxrpc .ahxrpc-sub{color:#cbd5e1;font-size:.9rem;margin:0 0 18px;}\n.ahxrpc label{display:block;color:#eef3ff;font-size:.88rem;font-weight:600;margin:14px 0 6px;}\n.ahxrpc input,.ahxrpc select{width:100%;padding:11px 12px;border-radius:7px;border:1px solid #334155;background:#1e293b;color:#fff;font-size:1rem;box-sizing:border-box;}\n.ahxrpc-btn{display:inline-block;margin-top:18px;padding:12px 22px;border-radius:7px;border:0;background:#2563eb;color:#fff;font-size:1rem;font-weight:600;cursor:pointer;}\n.ahxrpc-out{margin-top:18px;padding:16px 18px;border-radius:8px;background:#1e293b;border-left:4px solid #2563eb;display:none;}\n.ahxrpc-out.ahxrpc-show{display:block;}\n.ahxrpc-fig{font-size:1.9rem;font-weight:700;color:#fff;line-height:1.2;}\n.ahxrpc-note{color:#cbd5e1;font-size:.9rem;margin-top:8px;line-height:1.55;}\n.ahxrpc-warn{border-left-color:#ef4444;}\n.ahxrpc-ok{border-left-color:#4ade80;}\na.ahxrpc-cta.wp-element-button{display:inline-block;margin-top:16px;background:#2563eb!important;color:#fff!important;text-decoration:none!important;padding:11px 20px;border-radius:7px;font-weight:600;font-size:.95rem;}\n<\/style>\n<div class=\"ahxrpc\">\n  <h3>XML-RPC Worker Cost Calculator<\/h3>\n  <p class=\"ahxrpc-sub\">Convert your log count into entry process pressure.<\/p>\n  <label for=\"ahxrpc-hits\">XML-RPC requests in your log window<\/label>\n  <input type=\"number\" id=\"ahxrpc-hits\" min=\"0\" step=\"1\" value=\"3000\" inputmode=\"numeric\">\n  <label for=\"ahxrpc-hours\">Log window length in hours<\/label>\n  <input type=\"number\" id=\"ahxrpc-hours\" min=\"1\" step=\"1\" value=\"18\" inputmode=\"numeric\">\n  <label for=\"ahxrpc-plan\">Your entry process ceiling<\/label>\n  <select id=\"ahxrpc-plan\">\n    <option value=\"15\">15 EP &#8211; Bronze tier<\/option>\n    <option value=\"25\">25 EP &#8211; Silver or WooCommerce tier<\/option>\n    <option value=\"40\">40 EP &#8211; Gold tier<\/option>\n  <\/select>\n  <button type=\"button\" class=\"ahxrpc-btn\" data-ahxrpc=\"go\">Calculate worker cost<\/button>\n  <div class=\"ahxrpc-out\" id=\"ahxrpc-out\" role=\"status\" aria-live=\"polite\"><\/div>\n<\/div>\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var wrap = document.querySelector('.ahxrpc');\n    if (!wrap) { return; }\n    var out = document.getElementById('ahxrpc-out');\n    if (!out) { return; }\n    wrap.addEventListener('click', function(e){\n      var t = e.target;\n      if (!t) { return; }\n      if (t.getAttribute('data-ahxrpc') !== 'go') { return; }\n      var hEl = document.getElementById('ahxrpc-hits');\n      var wEl = document.getElementById('ahxrpc-hours');\n      var pEl = document.getElementById('ahxrpc-plan');\n      if (!hEl) { return; }\n      if (!wEl) { return; }\n      if (!pEl) { return; }\n      var hits = parseFloat(hEl.value);\n      var hours = parseFloat(wEl.value);\n      var ep = parseFloat(pEl.value);\n      if (isNaN(hits)) { hits = 0; }\n      if (isNaN(hours)) { hours = 1; }\n      if (hours < 1) { hours = 1; }\n      var perMin = hits \/ (hours * 60);\n      var perMinR = Math.round(perMin * 10) \/ 10;\n      \/\/ assume a 1s average uncached execution, so requests-per-minute maps to workers-per-second pressure\n      var pct = Math.round((perMin \/ ep) * 100);\n      var cls = 'ahxrpc-out ahxrpc-show ahxrpc-ok';\n      var verdict = 'This is background scanning noise. Blocking still frees workers, but it is not your bottleneck.';\n      if (pct >= 25) {\n        cls = 'ahxrpc-out ahxrpc-show';\n        verdict = 'Measurable pressure. Blocking will show up in your cache hit ratio and entry process graph.';\n      }\n      if (pct >= 100) {\n        cls = 'ahxrpc-out ahxrpc-show ahxrpc-warn';\n        verdict = 'The flood alone is requesting your entire concurrency allocation. Real visitors are queueing behind bots.';\n      }\n      out.className = cls;\n      var html = '';\n      html += '<div class=\"ahxrpc-fig\">' + perMinR + ' requests\/min<\/div>';\n      html += '<div class=\"ahxrpc-note\">Against a ' + ep + ' entry process ceiling, that is roughly <strong>' + pct + '%<\/strong> of your plan\\'s concurrent capacity requested every minute by bots.<\/div>';\n      html += '<div class=\"ahxrpc-note\">' + verdict + '<\/div>';\n      html += '<a class=\"ahxrpc-cta wp-element-button\" href=\"https:\/\/www.ahosting.net\/vps-hosting.html\">Compare higher-concurrency plans<\/a>';\n      out.innerHTML = html;\n    });\n  });\n})();\n<\/script>\n\n\n\n<p class=\"wp-block-paragraph\">Importantly, this estimate assumes roughly one second of uncached execution per request, which is typical for WordPress on shared infrastructure. Furthermore, if your result exceeds your ceiling, blocking is urgent rather than optional \u2014 and if it still exceeds capacity after blocking, the underlying concurrency headroom is the real constraint. Our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-php-workers-503-errors-2026\/\">how many PHP workers your WordPress site actually needs<\/a> covers how to size that properly.<\/p>\n\n\n\n<h2 id=\"aioseo-when-blocking-is-not-enough-61\" class=\"wp-block-heading\">When Blocking Is Not Enough<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ultimately, an <code>.htaccess<\/code> deny returns 403 cheaply, but the request still arrives, still occupies a connection slot, and still appears in your logs. For the volumes in our sample this is entirely sustainable. However, at sustained rates well beyond what we measured, the connection handling itself becomes the constraint.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore the escalation path runs in three stages. Firstly, add an edge or firewall rule so the traffic is refused before it reaches your server at all \u2014 layered with, never instead of, the origin rule. Secondly, if a small number of source addresses dominate as they did in our sample, block those ranges at the firewall level. Thirdly, if your site genuinely needs more concurrent capacity for legitimate traffic, <a href=\"https:\/\/www.ahosting.net\/dedicated-server.html\">dedicated server infrastructure<\/a> removes the shared ceiling entirely.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, agencies managing many client sites face this at multiplied scale, since every unprotected client site is an independent target. Applying the same rule across a portfolio at provisioning time is far cheaper than diagnosing it per site later, which is one practical argument for <a href=\"https:\/\/www.ahosting.net\/reseller-hosting.html\">isolated per-client hosting accounts<\/a>.<\/p>\n\n\n\n<h2 id=\"aioseo-your-xml-rpc-bot-flood-checklist-65\" class=\"wp-block-heading\">Your XML-RPC Bot Flood Checklist<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Count <code>xmlrpc.php<\/code> hits in both your SSL and non-SSL raw access logs<\/li>\n\n\n\n<li>Measure what share carries a Jetpack user agent before deciding the method<\/li>\n\n\n\n<li>Confirm you are on WordPress 4.4 or newer, so the multicall amplification window is closed<\/li>\n\n\n\n<li>Apply the rule in <code>.htaccess<\/code> above the <code># BEGIN WordPress<\/code> marker<\/li>\n\n\n\n<li>Allowlist Automattic ranges first if Jetpack handles your stats, backups, or Publicize<\/li>\n\n\n\n<li>Verify 403 on both HTTPS and plain HTTP<\/li>\n\n\n\n<li>Re-check the access log an hour later for 403 status codes on new entries<\/li>\n\n\n\n<li>Watch entry process usage and cache hit ratio recover over the following day<\/li>\n\n\n\n<li>Never rely on a PHP security plugin alone \u2014 it consumes the worker it blocks<\/li>\n<\/ul>\n\n\n\n<h2 id=\"faq-xml-rpc-bot-flood\" class=\"wp-block-heading\">Frequently Asked Questions: Stopping an XML-RPC Bot Flood<\/h2>\n\n\n\n<h3 id=\"faq-stop-without-breaking-jetpack\" class=\"wp-block-heading\">How do I stop an XML-RPC bot flood without breaking Jetpack in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, allowlist Jetpack&#8217;s Automattic IP ranges first, then deny xmlrpc.php for everyone else in .htaccess so the request is refused at the web server before WordPress loads. In our July 2026 server logs, Jetpack accounted for 47 percent of all XML-RPC traffic, so a blanket deny would have broken nearly half the observed requests. The full allowlist syntax appears in the numbered fix section.<\/p>\n\n\n\n<h3 id=\"faq-multicall-still-threat\" class=\"wp-block-heading\">Is the system.multicall XML-RPC amplification attack still a threat in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, no. WordPress core patched it in version 4.4, released December 2015, via Trac ticket 34336: once one authentication attempt inside a system.multicall batch fails, every remaining attempt in that batch fails too. Much of the advice ranking for this problem still describes the pre-4.4 mechanic. The 2026 problem is sequential request volume, not batched credential amplification.<\/p>\n\n\n\n<h3 id=\"faq-503-not-508\" class=\"wp-block-heading\">Why does my site show a 503 error instead of a 508 during an XML-RPC flood?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, LiteSpeed queues requests when your entry process ceiling is reached rather than rejecting them instantly, so the visitor waits and then receives a 503 only if the queue window expires first. Apache-based hosts surface the same underlying concurrency event as a literal 508 page. Both errors mean the same thing: no free PHP worker.<\/p>\n\n\n\n<h3 id=\"faq-workers-consumed-ahosting\" class=\"wp-block-heading\">How many PHP workers does an XML-RPC flood consume on AHosting shared hosting plans?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, one uncacheable PHP worker per request that reaches WordPress. In our July 2026 measurement window the busiest account sustained 59 XML-RPC POSTs per minute against a 15 entry process ceiling, the AHosting Bronze allocation. Consequently the flood alone can saturate the plan&#8217;s entire concurrency allocation before a single real visitor is served.<\/p>\n\n\n\n<h3 id=\"faq-plugin-vs-htaccess-ahosting\" class=\"wp-block-heading\">Should I block xmlrpc.php with a plugin or with .htaccess on AHosting WordPress hosting?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore use .htaccess. A PHP-based security plugin still boots WordPress to decide the request should be denied, which consumes the entry process you were trying to protect. A web server rule refuses the request before PHP ever loads, so the worker is never allocated. WordPress core developers state the same thing: denial of service against xmlrpc.php needs handling at the server level.<\/p>\n\n\n\n<h3 id=\"faq-cloudflare-port-80\" class=\"wp-block-heading\">Does blocking xmlrpc.php at Cloudflare protect the plain HTTP port 80 path too?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Importantly, not necessarily. One account in our July 2026 logs recorded 2,296 XML-RPC POSTs on port 80 alongside 964 on port 443. Consequently an edge rule scoped only to HTTPS traffic can leave the plain HTTP path fully open. Always verify the block returns 403 on both schemes.<\/p>\n\n\n\n<h3 id=\"faq-404-share\" class=\"wp-block-heading\">What percentage of XML-RPC bot requests hit a file that does not even exist?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Interestingly, 56 percent in our July 2026 sample: 13,566 of 23,993 requests returned 404 because xmlrpc.php had already been removed or blocked on those accounts. In other words most of this traffic is indiscriminate scanning rather than targeted attack, and the accounts that matter are the 10,025 that returned 200.<\/p>\n\n\n\n<h3 id=\"faq-disable-vs-allowlist\" class=\"wp-block-heading\">When should I disable XML-RPC entirely versus allowlisting Jetpack on a WordPress site?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, deny it outright when nothing on the site uses XML-RPC: no Jetpack, no WordPress mobile app publishing, no remote editor, and no pingbacks you rely on. Allowlist instead when Jetpack handles your stats, backups, or Publicize. The comparison table in this guide names the trade-off for each method.<\/p>\n\n\n\n<h3 id=\"faq-confirm-block-working\" class=\"wp-block-heading\">How do I confirm an XML-RPC block is actually working on my WordPress site?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, request the file and confirm the response is 403 rather than 200 or 405. Then grep your raw access log for xmlrpc.php and confirm new entries show 403 status codes. Additionally, watch your cPanel entry process graph and cache hit ratio recover over the following hours.<\/p>\n\n\n\n<h3 id=\"faq-cache-hit-ratio-2026\" class=\"wp-block-heading\">Does an XML-RPC bot flood hurt cache hit ratio on AHosting LiteSpeed hosting in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fundamentally, yes. Every XML-RPC POST is uncacheable by definition, so it bypasses LiteSpeed Cache on AHosting entirely and executes PHP. As a result your cached-to-uncached ratio collapses in reporting, and the workers those requests occupy are unavailable to visitors whose pages would otherwise have been generated quickly.<\/p>\n\n\n\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var allH3s = document.querySelectorAll('h3.wp-block-heading');\n    var inFaq = false;\n    for (var i = 0; i < allH3s.length; i++) {\n      var h3 = allH3s[i];\n      var prev = h3.previousElementSibling;\n      if (prev) {\n        if (prev.tagName === 'H2') {\n          var prevId = prev.getAttribute('id');\n          if (prevId) {\n            if (prevId.indexOf('faq-') === 0) {\n              inFaq = true;\n            } else {\n              inFaq = false;\n            }\n          }\n        }\n      }\n      if (inFaq) {\n        initToggle(h3);\n      }\n    }\n    function initToggle(h3) {\n      var answer = h3.nextElementSibling;\n      if (!answer) { return; }\n      if (answer.tagName !== 'P') { return; }\n      var chev = document.createElement('span');\n      chev.className = 'ahfaq-chev ahfaq-chev-closed';\n      chev.setAttribute('aria-hidden', 'true');\n      h3.appendChild(chev);\n      h3.setAttribute('tabindex', '0');\n      h3.setAttribute('aria-expanded', 'false');\n      answer.classList.add('ahfaq-collapsed');\n      h3.addEventListener('click', function(){ doToggle(h3, answer, chev); });\n      h3.addEventListener('keydown', function(e){\n        if (e.key === 'Enter') { e.preventDefault(); doToggle(h3, answer, chev); }\n        if (e.key === ' ') { e.preventDefault(); doToggle(h3, answer, chev); }\n      });\n    }\n    function doToggle(h3, answer, chev) {\n      var isOpen = h3.getAttribute('aria-expanded') === 'true';\n      if (isOpen) {\n        answer.classList.remove('ahfaq-open');\n        answer.classList.add('ahfaq-collapsed');\n        h3.setAttribute('aria-expanded', 'false');\n        chev.classList.add('ahfaq-chev-closed');\n        chev.classList.remove('ahfaq-chev-open');\n      } else {\n        answer.classList.remove('ahfaq-collapsed');\n        answer.classList.add('ahfaq-open');\n        h3.setAttribute('aria-expanded', 'true');\n        chev.classList.remove('ahfaq-chev-closed');\n        chev.classList.add('ahfaq-chev-open');\n      }\n    }\n  });\n})();\n<\/script>\n\n","protected":false},"excerpt":{"rendered":"<p>TL;DR To stop an XML-RPC bot flood, allowlist Jetpack first, then deny xmlrpc.php in .htaccess so LiteSpeed refuses the request before WordPress loads and no PHP worker is consumed. An XML-RPC bot flood is the most expensive WordPress problem that never shows up on an uptime monitor. Your site responds. Your homepage loads. Yet your [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":991,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[128,8],"tags":[143,140,142,139,70,62,46,138,141,137],"class_list":["post-990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-how-to","category-wordpress","tag-bot-traffic","tag-entry-process","tag-htaccess","tag-jetpack","tag-litespeed","tag-php-workers","tag-wordpress-hosting","tag-wordpress-security","tag-xml-rpc","tag-xmlrpc-php"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"Matt Chrust\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"AHosting Blog Home | AHosting Blog\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting\" \/>\n\t\t<meta property=\"og:description\" content=\"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/stop-xml-rpc-bot-flood-ahosting.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/stop-xml-rpc-bot-flood-ahosting.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-21T20:59:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-22T09:34:41+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting\" \/>\n\t\t<meta name=\"twitter:description\" content=\"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/stop-xml-rpc-bot-flood-ahosting.webp\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#article\",\"name\":\"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting\",\"headline\":\"How to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)\",\"author\":{\"@type\":\"Person\",\"name\":\"Matt Chrust\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/stop-xml-rpc-bot-flood-ahosting.webp\",\"width\":1200,\"height\":675},\"datePublished\":\"2026-07-21T20:59:19+00:00\",\"dateModified\":\"2026-07-22T09:34:41+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#webpage\"},\"articleSection\":\"How To, WordPress, bot traffic, entry process, htaccess, jetpack, LiteSpeed, PHP workers, WordPress Hosting, wordpress security, xml-rpc, xmlrpc.php\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"position\":2,\"name\":\"WordPress\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#listItem\",\"name\":\"How to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#listItem\",\"position\":3,\"name\":\"How to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"},\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\",\"name\":\"AHosting\",\"description\":\"AHosting Blog\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/assets\\\/img\\\/ahosting-logo.svg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\",\"name\":\"Matt Chrust\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Matt Chrust\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/\",\"name\":\"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting\",\"description\":\"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/stop-xml-rpc-bot-flood-ahosting.webp\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#mainImage\",\"width\":1200,\"height\":675},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/stop-xml-rpc-bot-flood\\\/#mainImage\"},\"datePublished\":\"2026-07-21T20:59:19+00:00\",\"dateModified\":\"2026-07-22T09:34:41+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#website\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"name\":\"AHosting\",\"description\":\"AHosting Blog\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting","description":"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.","canonical_url":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#article","name":"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting","headline":"How to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)","author":{"@type":"Person","name":"Matt Chrust","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/"},"publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/stop-xml-rpc-bot-flood-ahosting.webp","width":1200,"height":675},"datePublished":"2026-07-21T20:59:19+00:00","dateModified":"2026-07-22T09:34:41+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#webpage"},"articleSection":"How To, WordPress, bot traffic, entry process, htaccess, jetpack, LiteSpeed, PHP workers, WordPress Hosting, wordpress security, xml-rpc, xmlrpc.php"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog#listItem","position":1,"name":"Home","item":"https:\/\/www.ahosting.net\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","position":2,"name":"WordPress","item":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#listItem","name":"How to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#listItem","position":3,"name":"How to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"},"item":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/"}]},{"@type":"Organization","@id":"https:\/\/www.ahosting.net\/#organization","name":"AHosting","description":"AHosting Blog","url":"https:\/\/www.ahosting.net\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/assets\/img\/ahosting-logo.svg","@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#organizationLogo"},"image":{"@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/","name":"Matt Chrust","image":{"@type":"ImageObject","@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g","width":96,"height":96,"caption":"Matt Chrust"}},{"@type":"WebPage","@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#webpage","url":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/","name":"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting","description":"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"creator":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/stop-xml-rpc-bot-flood-ahosting.webp","@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#mainImage","width":1200,"height":675},"primaryImageOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/#mainImage"},"datePublished":"2026-07-21T20:59:19+00:00","dateModified":"2026-07-22T09:34:41+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ahosting.net\/#website","url":"https:\/\/www.ahosting.net\/","name":"AHosting","description":"AHosting Blog","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"}}]},"og:locale":"en_US","og:site_name":"AHosting Blog Home | AHosting Blog","og:type":"article","og:title":"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting","og:description":"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.","og:url":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/","og:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/stop-xml-rpc-bot-flood-ahosting.webp","og:image:secure_url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/stop-xml-rpc-bot-flood-ahosting.webp","og:image:width":1200,"og:image:height":675,"article:published_time":"2026-07-21T20:59:19+00:00","article:modified_time":"2026-07-22T09:34:41+00:00","twitter:card":"summary_large_image","twitter:title":"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting","twitter:description":"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.","twitter:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/07\/stop-xml-rpc-bot-flood-ahosting.webp"},"aioseo_meta_data":{"post_id":"990","title":"Stop an XML-RPC Bot Flood - 2026 Fix | AHosting","description":"An XML-RPC bot flood burns PHP workers invisibly. In 2026, 47% of that traffic is Jetpack. Here is how to block it without breaking your own site.","keywords":null,"keyphrases":{"focus":{"keyphrase":"XML-RPC bot flood","score":100,"analysis":{"keyphraseInTitle":{"score":9,"maxScore":9,"error":0},"keyphraseInDescription":{"score":9,"maxScore":9,"error":0},"keyphraseLength":{"score":9,"maxScore":9,"error":0,"length":3},"keyphraseInURL":{"score":5,"maxScore":5,"error":0},"keyphraseInIntroduction":{"score":9,"maxScore":9,"error":0},"keyphraseInSubHeadings":{"score":9,"maxScore":9,"error":0},"keyphraseInImageAlt":[],"keywordDensity":{"type":"best","score":9,"maxScore":9,"error":0}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-07-21 20:55:18","updated":"2026-07-22 09:59:02","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/\" title=\"WordPress\">WordPress<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tHow to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ahosting.net\/blog"},{"label":"WordPress","link":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/"},{"label":"How to Stop an XML-RPC Bot Flood Without Breaking Jetpack (2026)","link":"https:\/\/www.ahosting.net\/blog\/stop-xml-rpc-bot-flood\/"}],"_links":{"self":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/comments?post=990"}],"version-history":[{"count":3,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/990\/revisions"}],"predecessor-version":[{"id":999,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/990\/revisions\/999"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media\/991"}],"wp:attachment":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media?parent=990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/categories?post=990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/tags?post=990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}