---
title: "XML-RPC Statistics 2026: 76.0% of WordPress Sites"
url: https://www.pagespeedmatters.com/resources/data-studies/xml-rpc-statistics
description: "76.0% of top 1M WordPress homepages link to xmlrpc.php in a link tag and 25.7% send a pingback link. WooCommerce stores: 85.8%. Top 10K sites: 65.0%."
lang: en
---
Data Study ยท Website Maintenance
# XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It
76.0% of top 1M WordPress homepages (86,494 of 113,804) link to xmlrpc.php in a link tag, and 25.7% still send a pingback link.
- 113,804 WordPress homepages
- HTTP Archive, Sept 2026
Matt Suffoletto: https://www.pagespeedmatters.com/resources/author/matt-suffoletto
Founder, PageSpeed Matters Published Oct. 19, 2026 6 min read
## Key Findings
1. 86,494 of 113,804 top 1M WordPress homepages (**76.0%**) link to xmlrpc.php in a link tag, and 29,268 (**25.7%**) still send a pingback link. Copy stat
2. **71.3%** of WordPress homepages (81,148) carry the EditURI (RSD) link itself, and **76.4%** (86,959) advertise XML-RPC through at least one of the RSD link, a pingback link or another link to xmlrpc.php. Copy stat
3. Larger sites advertise it less: **65.0%** of 637 Top 10K WordPress homepages link to xmlrpc.php, against 70.4% of 7,139 Top 100K and **76.4%** of 106,028 homepages in the rest of the top 1M. Pingback links follow the same pattern at 20.1%, 21.3% and 26.0%. Copy stat
4. WooCommerce stores are the most likely to advertise it: **85.8%** of 21,999 WordPress homepages running WooCommerce link to xmlrpc.php and **39.2%** send a pingback link, against 73.6% and 22.5% of 91,805 WordPress homepages without it. Copy stat
WordPress homepages linking to xmlrpc.php, by site popularity
Top 10K 65%
Top 100K 70.4%
Rest of top 1M 76.4%
Source: PageSpeed Matters. HTTP Archive top 1M crawl, Sept 2026, mobile.
A link does not confirm the endpoint is enabled.
In this study
## WordPress homepages advertising XML-RPC (Sept 2026, top 1M)
| Group | Links to xmlrpc.php | RSD (EditURI) link | Pingback link | Homepages |
| --- | --- | --- | --- | --- |
| Top 10K | 65.0% | 60.9% | 20.1% | 637 |
| Top 100K | 70.4% | 65.3% | 21.3% | 7,139 |
| Rest of top 1M | 76.4% | 71.8% | 26.0% | 106,028 |
| With WooCommerce | 85.8% | 79.9% | 39.2% | 21,999 |
| Without WooCommerce | 73.6% | 69.2% | 22.5% | 91,805 |
| All WordPress | 76.0% | 71.3% | 25.7% | 113,804 |
Source: PageSpeed Matters, HTTP Archive, Sept 2026. A link to xmlrpc.php does not confirm XML-RPC is enabled.
## Summary
xmlrpc.php is WordPress's older remote publishing endpoint. It lets apps and outside services post content and send pingbacks, and it is also a well-known target for automated login attempts. WordPress points to it from the page head by default, through an RSD (EditURI) link and, on many themes, a pingback link.
We checked how many popular WordPress sites still advertise it. 76.0% of top 1M WordPress homepages, 86,494 of 113,804, link to xmlrpc.php in a link tag, and 25.7% still send a pingback link. A link does not prove the endpoint is switched on, but it tells anyone scanning the site where to look.
## What we measured
We looked at the HTTP Archive crawl from September 2026, on mobile, covering the top 1M sites by Chrome traffic. A homepage counts as WordPress when the crawl identifies it as a WordPress site: 113,804 homepages.
For each homepage we read the link tags in the page and checked for three things: an EditURI (RSD) link, a pingback link, and any link tag whose address contains xmlrpc.php. The headline figure is any link tag pointing to xmlrpc.php, not the RSD link alone.
One limit matters. A link to the endpoint does not confirm XML-RPC is enabled, because a site can block the endpoint at the server and still print the link. So this study measures how many sites advertise XML-RPC, not how many are open to attack through it.
## Three in four WordPress homepages advertise XML-RPC
86,494 of 113,804 top 1M WordPress homepages (76.0%) link to xmlrpc.php in a link tag. 29,268 (25.7%) still send a pingback link, a feature many sites no longer use.
Most of that comes from the RSD link WordPress adds by default. 71.3% of WordPress homepages (81,148) carry the EditURI (RSD) link itself. Counting every route, 76.4% (86,959) advertise XML-RPC through at least one of the RSD link, a pingback link or another link to xmlrpc.php. Few site owners remove these default links.
76.0%
Share of 113,804 top 1M WordPress homepages with a link tag pointing to xmlrpc.php.
## Larger sites advertise it less
The most visited WordPress sites are less likely to advertise XML-RPC. 65.0% of 637 Top 10K WordPress homepages link to xmlrpc.php, against 70.4% of 7,139 Top 100K homepages and 76.4% of 106,028 homepages in the rest of the top 1M.
Pingback links follow the same pattern: 20.1% in the Top 10K, 21.3% in the Top 100K and 26.0% in the rest of the top 1M. Larger sites likely have more people tidying up the page head, but even in the Top 10K about two thirds still advertise the endpoint.
## WooCommerce stores advertise it most
WordPress sites running WooCommerce are the most likely to advertise XML-RPC. 85.8% of 21,999 WooCommerce homepages link to xmlrpc.php and 39.2% send a pingback link, against 73.6% and 22.5% of 91,805 WordPress homepages without WooCommerce.
The data does not show why, so read it as a pattern rather than a cause. For stores that hold customer accounts, leaving the endpoint advertised is an easy thing to clean up.
## What this means for your site
First, find out whether you use XML-RPC at all. Some mobile publishing apps and remote publishing services still rely on it. Newer WordPress tools mostly use the REST API instead, and many sites have no need for XML-RPC.
If you do not need it, disable it. A security plugin can turn it off, or your host or developer can block requests to xmlrpc.php at the server. Then remove the RSD and pingback links from the page head so the site stops advertising it, and turn off pingbacks in Settings, then Discussion.
If you do need it, keep it but protect it: limit login attempts, use strong passwords and two-factor login, and keep WordPress and plugins up to date. Check the result by viewing your homepage source and searching for 'xmlrpc'.
## Sources
- HTTP Archive crawl of the top 1M sites by Chrome traffic, September 2026, mobile: link tags on WordPress homepages
## Embed this research
Paste this on your site to embed the chart. It links back to the source automatically.
Source: XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It - PageSpeed Matters
## Frequently asked questions
### How many WordPress sites have XML-RPC enabled?
We measured how many advertise it, which is not the same as enabled. 76.0% of top 1M WordPress homepages link to xmlrpc.php in a link tag, and 25.7% send a pingback link.
### What is xmlrpc.php in WordPress?
It is WordPress's older remote publishing endpoint, used by some apps and services to post content and by pingbacks. 71.3% of top 1M WordPress homepages point to it through the RSD (EditURI) link WordPress adds to the page head.
### Do WooCommerce stores advertise XML-RPC more often?
Yes. 85.8% of WordPress homepages running WooCommerce link to xmlrpc.php and 39.2% send a pingback link, against 73.6% and 22.5% of WordPress homepages without WooCommerce.
### How do I check if my site advertises XML-RPC?
View your homepage source and search for 'xmlrpc' and 'pingback'. Any link tag pointing to xmlrpc.php means the site advertises the endpoint, whether or not it is enabled.
Most sites can switch off XML-RPC and remove its links in a few minutes, which closes a common target for automated login attempts. Need help with this? See our WordPress support services (https://www.pagespeedmatters.com/services/wordpress-maintenance).
Share
How we measured
## Methodology & Source
Data source
HTTP Archive crawl of the top 1M sites by Chrome traffic
Collection date
September 2026
Sample
113,804 WordPress homepages
Release
HTTP Archive, Sept 2026
Sept 2026 HTTP Archive WordPress homepages, mobile, identified as WordPress by the crawl (113,804 homepages). Link tags checked for an EditURI (RSD) link, a pingback link and any address containing xmlrpc.php. The headline counts any link tag pointing to xmlrpc.php, not the RSD link alone. A link to the endpoint does not confirm XML-RPC is enabled, so these figures show sites that advertise it, not sites exposed to attack.
Using this data?
## Cite this study
Link back to the study when you cite it.
APA
Matt Suffoletto. (2026). XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It. PageSpeed Matters. https://www.pagespeedmatters.com/resources/data-studies/xml-rpc-statistics
Plain link
XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It - PageSpeed Matters - https://www.pagespeedmatters.com/resources/data-studies/xml-rpc-statistics
## Related studies
- Website Maintenance WordPress Version Exposure: 52.8% of WordPress Sites Show It: https://www.pagespeedmatters.com/resources/data-studies/wordpress-version-exposure
- Website Maintenance WordPress Version Statistics 2026: 18.7% Run Old Releases: https://www.pagespeedmatters.com/resources/data-studies/wordpress-version-statistics
- Website Maintenance Server Version Disclosure: 14.8% of Top 1M Sites: https://www.pagespeedmatters.com/resources/data-studies/server-version-disclosure
- Website Maintenance admin-ajax.php Statistics: 13.1% of WordPress Homepages: https://www.pagespeedmatters.com/resources/data-studies/admin-ajax-php-statistics
## Ready to Get Started?
Get your site optimized in as little as 3 days. From $500.
See Plans & Pricing: https://www.pagespeedmatters.com/pricing
## Structured data
```json
[
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It",
"datePublished": "2026-10-19",
"dateModified": "2026-10-19",
"author": {
"@type": "Person",
"name": "Matt Suffoletto",
"jobTitle": "Performance Optimization Expert",
"url": "https://www.pagespeedmatters.com/resources/author/matt-suffoletto"
}
},
{
"@context": "https://schema.org",
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"position": 1,
"name": "Home",
"item": "https://www.pagespeedmatters.com/"
},
{
"@type": "ListItem",
"position": 2,
"name": "Resources",
"item": "https://www.pagespeedmatters.com/resources"
},
{
"@type": "ListItem",
"position": 3,
"name": "Data Studies",
"item": "https://www.pagespeedmatters.com/resources/data-studies"
},
{
"@type": "ListItem",
"position": 4,
"name": "XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It"
}
]
},
{
"@context": "https://schema.org",
"@type": "Dataset",
"name": "XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It",
"description": "76.0% of top 1M WordPress homepages link to xmlrpc.php in a link tag and 25.7% send a pingback link. WooCommerce stores: 85.8%. Top 10K sites: 65.0%.",
"url": "https://www.pagespeedmatters.com/resources/data-studies/xml-rpc-statistics",
"creator": {
"@type": "Organization",
"name": "PageSpeed Matters",
"url": "https://www.pagespeedmatters.com"
},
"datePublished": "2026-10-19",
"dateModified": "2026-10-19",
"license": "https://creativecommons.org/licenses/by/4.0/",
"isAccessibleForFree": true,
"creativeWorkStatus": "Published",
"variableMeasured": "Core Web Vitals pass rate and web performance metrics",
"measurementTechnique": "HTTP Archive crawl of the top 1M sites by Chrome traffic"
},
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "How many WordPress sites have XML-RPC enabled?",
"acceptedAnswer": {
"@type": "Answer",
"text": "We measured how many advertise it, which is not the same as enabled. 76.0% of top 1M WordPress homepages link to xmlrpc.php in a link tag, and 25.7% send a pingback link."
}
},
{
"@type": "Question",
"name": "What is xmlrpc.php in WordPress?",
"acceptedAnswer": {
"@type": "Answer",
"text": "It is WordPress's older remote publishing endpoint, used by some apps and services to post content and by pingbacks. 71.3% of top 1M WordPress homepages point to it through the RSD (EditURI) link WordPress adds to the page head."
}
},
{
"@type": "Question",
"name": "Do WooCommerce stores advertise XML-RPC more often?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. 85.8% of WordPress homepages running WooCommerce link to xmlrpc.php and 39.2% send a pingback link, against 73.6% and 22.5% of WordPress homepages without WooCommerce."
}
},
{
"@type": "Question",
"name": "How do I check if my site advertises XML-RPC?",
"acceptedAnswer": {
"@type": "Answer",
"text": "View your homepage source and search for 'xmlrpc' and 'pingback'. Any link tag pointing to xmlrpc.php means the site advertises the endpoint, whether or not it is enabled."
}
}
]
}
]
```