---
title: "xmlrpc.php POST requests to WordPress methods"
canonical_url: "https://www.speedzone.fi/tuki/en/kb/xmlrpcphp-post-requests-to-wordpress-methods/"
post_type: "ht_kb"
published: "2024-10-17T08:55:32+00:00"
modified: "2025-10-17T12:19:53+00:00"
language: "en"
author: "kati"
taxonomies:
  ht_kb_category:
    - name: "Apache"
      url: "https://www.speedzone.fi/tuki/en/kb-categories/apache-en/"
    - name: "Technical"
      url: "https://www.speedzone.fi/tuki/en/kb-categories/technical-en/"
    - name: "WordPress"
      url: "https://www.speedzone.fi/tuki/en/kb-categories/wordpress-en/"
  ht_kb_tag:
    - name: "POST requests"
      url: "https://www.speedzone.fi/tuki/en/kb-tags/post-requests/"
    - name: "Error 403"
      url: "https://www.speedzone.fi/tuki/en/kb-tags/error-403/"
    - name: "Apache directives"
      url: "https://www.speedzone.fi/tuki/en/kb-tags/apache-directives/"
    - name: "POST"
      url: "https://www.speedzone.fi/tuki/en/kb-tags/post/"
    - name: "xmlrpc.php"
      url: "https://www.speedzone.fi/tuki/en/kb-tags/xmlrpcphp/"
---

# xmlrpc.php POST requests to WordPress methods

Protection has been added to Zone [webhosting](https://www.zone.fi/en/web-hosting/) websites to block POST requests to files named `xmlrpc.php` that contain a WordPress (`wp.*`) method. The purpose of the xmlrpc.php POST requests restriction is to protect the homepage from bots that try to guess passwords.

Corresponding requests will return `Error 403: Forbidden`.
Apache apache.ssl.error.log will display a following error message:

```
ModSecurity: Access denied with code 403 ... [msg "Blocked wp.* payload in XML-RPC"] [hostname "example.com"] [uri "/xmlrpc.php"] ...
```

If desired, it is possible to remove the corresponding block from your server.

In order to remove this xmlrpc.php POST requests restriction, you need to log into [`My Zone`](https://my.zone.fi/en/zid/server/auth) control panel and in the `Webserver` section of the web hosting management under `Main Domain Setting`s -> `modify` -> `Apache Directives` -> in the `add directive block` window, add a directive block with the following content:

```
<IfModule mod_security2.c>
  SecRuleRemoveById 60020 60021
</IfModule>
```

[![](https://www.speedzone.fi/static/sites/5/wordpress-homepage-protection-1-1024x629.jpg)](https://www.speedzone.fi/tuki/en/kb/xmlrpcphp-post-requests-to-wordpress-methods/wordpress-homepage-protection-2/)