Secure XML-RPC
Rather than sending usernames and passwords in plain text with every request, we’re going to use a set of public/secret keys to hash data and authenticate instead.
Consider an alternative
Secure XML-RPC shows warning signs in 2026 — compare the alternatives below before installing. It runs on 50+ sites, is rated 3.7/5 and was last updated 12 years ago, and scores 28/100 on our health check.
- Small user base (50+ active installs)
- Very few reviews so far
- No update in 12 years
- Only tested up to WordPress 4.0 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Secure XML-RPC stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| authentication | >100 |
| oauth | >100 |
| security | >100 |
| xmlrpc | >100 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 3.7 from 3 reviews
About Secure XML-RPC
From the official readme · v1.0.0Description
Rather than sending usernames and passwords in plain text with every request, we’re going to use a set of public/secret keys to hash data and authenticate instead.
On your WordPress profile, you will see a new “Remote Publishing Permissions” section listing out the applications that have permission to publish, along with their public and secret keys.
New applications can be added whenever you want. You can also change the names of applications, or revoke publishing permission by deleting them.
Additional Information
Lock graphic designed by Scott Lewis from the thenounproject.com
Installation
Manual Installation
- Upload the entire
/secure-xml-rpcdirectory to the/wp-content/plugins/directory. - Activate Secure XML-RPC through the ‘Plugins’ menu in WordPress.
Changelog
The hashing mechanism for generating authentication headers has changed slightly. Please refer to the FAWs for an example of how things work with a double-hash in the newest version.
1.0.0
- New: Add a custom RPC method for generating application keys remotely.
- Dev change: Move all functional implementations inside our pseudo-namespace.
- Dev change: Use a constant-time string comparison method for better security and less data leakage during authentication.
- Dev change: Use a double-hash to prevent any potential length-extension attacks.
0.1.0
- First release
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Secure XML-RPC alternatives
All authentication plugins →
FAQ
Secure XML-RPC: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Sep 28, 2026
Is Secure XML-RPC free?
Yes. Secure XML-RPC is free to download and use from the official WordPress.org plugin directory.
Is Secure XML-RPC safe to use in 2026?
Secure XML-RPC shows warning signs in 2026 — compare the alternatives below before installing. It runs on 50+ sites, is rated 3.7/5 and was last updated 12 years ago, and scores 28/100 on our health check.
How many websites use Secure XML-RPC?
Secure XML-RPC is active on 50+ WordPress websites and has been downloaded 7,129 times since it launched in January 2014. It was downloaded 54 times in the last 30 days.
Does Secure XML-RPC work with WordPress 7.1?
Secure XML-RPC is officially tested up to WordPress 4.0.38, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
When was Secure XML-RPC last updated?
The latest version, 1.0.0, was released on August 30, 2014 (12 years ago).
Who makes Secure XML-RPC?
Secure XML-RPC is developed and maintained by Eric Mann.
What are the best alternatives to Secure XML-RPC?
The most popular alternatives to Secure XML-RPC are Limit Login Attempts (300K+ installs), WPS Limit Login (100K+ installs) and Two Factor (100K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
