WordPress homepages advertising XML-RPC (Sept 2026, top 1M)
| Group | Links to xmlrpc.php | RSD (EditURI) link | Pingback link | Homepages |
|---|---|---|---|---|
| Top 10K | 65.0% | 60.9% | 20.1% | 637 |
| Top 100K | 70.4% | 65.3% | 21.3% | 7,139 |
| Rest of top 1M | 76.4% | 71.8% | 26.0% | 106,028 |
| With WooCommerce | 85.8% | 79.9% | 39.2% | 21,999 |
| Without WooCommerce | 73.6% | 69.2% | 22.5% | 91,805 |
| All WordPress | 76.0% | 71.3% | 25.7% | 113,804 |
Source: PageSpeed Matters, HTTP Archive, Sept 2026. A link to xmlrpc.php does not confirm XML-RPC is enabled.
Summary
xmlrpc.php is WordPress's older remote publishing endpoint. It lets apps and outside services post content and send pingbacks, and it is also a well-known target for automated login attempts. WordPress points to it from the page head by default, through an RSD (EditURI) link and, on many themes, a pingback link.
We checked how many popular WordPress sites still advertise it. 76.0% of top 1M WordPress homepages, 86,494 of 113,804, link to xmlrpc.php in a link tag, and 25.7% still send a pingback link. A link does not prove the endpoint is switched on, but it tells anyone scanning the site where to look.
What we measured
We looked at the HTTP Archive crawl from September 2026, on mobile, covering the top 1M sites by Chrome traffic. A homepage counts as WordPress when the crawl identifies it as a WordPress site: 113,804 homepages.
For each homepage we read the link tags in the page and checked for three things: an EditURI (RSD) link, a pingback link, and any link tag whose address contains xmlrpc.php. The headline figure is any link tag pointing to xmlrpc.php, not the RSD link alone.
One limit matters. A link to the endpoint does not confirm XML-RPC is enabled, because a site can block the endpoint at the server and still print the link. So this study measures how many sites advertise XML-RPC, not how many are open to attack through it.
Three in four WordPress homepages advertise XML-RPC
86,494 of 113,804 top 1M WordPress homepages (76.0%) link to xmlrpc.php in a link tag. 29,268 (25.7%) still send a pingback link, a feature many sites no longer use.
Most of that comes from the RSD link WordPress adds by default. 71.3% of WordPress homepages (81,148) carry the EditURI (RSD) link itself. Counting every route, 76.4% (86,959) advertise XML-RPC through at least one of the RSD link, a pingback link or another link to xmlrpc.php. Few site owners remove these default links.
76.0%
Share of 113,804 top 1M WordPress homepages with a link tag pointing to xmlrpc.php.
Larger sites advertise it less
The most visited WordPress sites are less likely to advertise XML-RPC. 65.0% of 637 Top 10K WordPress homepages link to xmlrpc.php, against 70.4% of 7,139 Top 100K homepages and 76.4% of 106,028 homepages in the rest of the top 1M.
Pingback links follow the same pattern: 20.1% in the Top 10K, 21.3% in the Top 100K and 26.0% in the rest of the top 1M. Larger sites likely have more people tidying up the page head, but even in the Top 10K about two thirds still advertise the endpoint.
WooCommerce stores advertise it most
WordPress sites running WooCommerce are the most likely to advertise XML-RPC. 85.8% of 21,999 WooCommerce homepages link to xmlrpc.php and 39.2% send a pingback link, against 73.6% and 22.5% of 91,805 WordPress homepages without WooCommerce.
The data does not show why, so read it as a pattern rather than a cause. For stores that hold customer accounts, leaving the endpoint advertised is an easy thing to clean up.
What this means for your site
First, find out whether you use XML-RPC at all. Some mobile publishing apps and remote publishing services still rely on it. Newer WordPress tools mostly use the REST API instead, and many sites have no need for XML-RPC.
If you do not need it, disable it. A security plugin can turn it off, or your host or developer can block requests to xmlrpc.php at the server. Then remove the RSD and pingback links from the page head so the site stops advertising it, and turn off pingbacks in Settings, then Discussion.
If you do need it, keep it but protect it: limit login attempts, use strong passwords and two-factor login, and keep WordPress and plugins up to date. Check the result by viewing your homepage source and searching for 'xmlrpc'.
Sources
- HTTP Archive crawl of the top 1M sites by Chrome traffic, September 2026, mobile: link tags on WordPress homepages
Embed this research
Paste this on your site to embed the chart. It links back to the source automatically.
<iframe id="psm-xml-rpc-statistics" src="https://www.pagespeedmatters.com/embed/data-studies/xml-rpc-statistics" width="100%" height="600" style="width:100%;border:1px solid #E2E3E1;border-radius:12px" loading="lazy" title="XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It - PageSpeed Matters"></iframe>
<script>window.addEventListener("message",function(e){if(e&&e.data&&e.data.psmEmbed==="xml-rpc-statistics"&&e.data.height){var f=document.getElementById("psm-xml-rpc-statistics");if(f){f.style.height=e.data.height+"px";}}});</script>
<p style="font:14px/1.5 system-ui,sans-serif">Source: <a href="https://www.pagespeedmatters.com/resources/data-studies/xml-rpc-statistics">XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It - PageSpeed Matters</a></p>
Frequently asked questions
How many WordPress sites have XML-RPC enabled?
We measured how many advertise it, which is not the same as enabled. 76.0% of top 1M WordPress homepages link to xmlrpc.php in a link tag, and 25.7% send a pingback link.
What is xmlrpc.php in WordPress?
It is WordPress's older remote publishing endpoint, used by some apps and services to post content and by pingbacks. 71.3% of top 1M WordPress homepages point to it through the RSD (EditURI) link WordPress adds to the page head.
Do WooCommerce stores advertise XML-RPC more often?
Yes. 85.8% of WordPress homepages running WooCommerce link to xmlrpc.php and 39.2% send a pingback link, against 73.6% and 22.5% of WordPress homepages without WooCommerce.
How do I check if my site advertises XML-RPC?
View your homepage source and search for 'xmlrpc' and 'pingback'. Any link tag pointing to xmlrpc.php means the site advertises the endpoint, whether or not it is enabled.
Most sites can switch off XML-RPC and remove its links in a few minutes, which closes a common target for automated login attempts. Need help with this? See our WordPress support services.