WordPress XML-RPC Risks: 49.9% Exposed & Low Security Scores

As the backbone of over 40% of the internet, WordPress’s ubiquity is undeniable. However, this popularity also makes it a prime target for attackers. At heypulso.com, we continuously scan vast swathes of the internet to identify security risks and help site owners harden their defenses. Our latest comprehensive scan, encompassing 43,960 domains, reveals a concerning landscape, particularly around the often-overlooked XML-RPC interface and broader site maintenance.

Out of the total domains scanned, we identified a significant 10,984 active WordPress sites. Our findings paint a stark picture: while some progress has been made in areas like SSL adoption, critical vulnerabilities persist, with nearly half of all WordPress sites exposing a direct attack vector.

The Pervasive Threat of Exposed XML-RPC

XML-RPC (Extensible Markup Language – Remote Procedure Call) is a feature in WordPress that allows external applications to interact with your site, facilitating remote publishing, pingbacks, and trackbacks. While designed for convenience, its powerful capabilities have long been exploited by malicious actors. Attackers frequently leverage XML-RPC for:

• Brute-force attacks: Using the system.multicall method, attackers can send thousands of username/password combinations in a single request, bypassing traditional brute-force protection measures and making it easier to compromise administrative accounts.
• DDoS amplification: Malicious actors can use the pingback functionality to launch distributed denial-of-service (DDoS) attacks, overwhelming target sites with amplified traffic.
• Remote Code Execution (RCE): Although less direct, vulnerabilities in plugins that interact with XML-RPC can sometimes lead to RCE if an attacker gains control over the XML-RPC requests.

Our scanner data reveals that a significant 49.9% of the WordPress sites we analyzed have XML-RPC exposed. This means nearly half of all WordPress sites are potentially vulnerable to these well-known attack vectors, opening a wide door for automated exploits and targeted attacks. For many site owners, especially those not actively using remote publishing tools, keeping XML-RPC enabled is an unnecessary risk.

A Look Beneath the Surface: General WordPress Security Posture

Beyond XML-RPC, our scan delves into the broader security posture of WordPress sites, revealing several areas of concern that, when combined with exposed XML-RPC, create a compounding risk.

SSL Adoption: A Mixed Bag

While the push for HTTPS has been significant, our data shows there’s still work to be done. Out of the 43,960 domains scanned, 23,701 (53.9%) have a valid SSL certificate. While over half is a positive step, it means nearly half of all sites are still serving content over unencrypted HTTP, leaving user data vulnerable to interception and diminishing trust.

Critical Gaps in Security Headers

Security headers are a fundamental layer of defense, instructing browsers on how to behave when interacting with your site, mitigating common client-side attacks. Our scan uncovered alarming omissions among WordPress sites:

• 82.9% missing X-Frame-Options: This header prevents clickjacking attacks by controlling whether your site can be embedded in an iframe on another domain. Its absence leaves users vulnerable to deceptive overlays and malicious interactions.
• 88.1% missing Content Security Policy (CSP): CSP is a powerful header that helps prevent Cross-Site Scripting (XSS) and other code injection attacks by specifying which dynamic resources (scripts, styles, etc.) are allowed to load. Its widespread absence is a critical oversight, leaving sites exposed to one of the most common web vulnerabilities.
• 77.9% missing HTTP Strict Transport Security (HSTS): HSTS forces browsers to interact with your site only over HTTPS, preventing protocol downgrade attacks and ensuring all communication is encrypted. The lack of HSTS on over three-quarters of WordPress sites means many users are still susceptible to man-in-the-middle attacks that could downgrade their connection to insecure HTTP.

These statistics highlight a systemic neglect of basic security hardening, leaving WordPress sites unnecessarily exposed to a range of client-side attacks.

The Alarming State of WordPress Maintenance Scores

Our proprietary Maintenance Scores grade sites based on various factors, including updates, configurations, and overall health. For the 10,984 WordPress sites we graded, the distribution is a significant cause for concern:

Grade	Score Range	Number of Sites	Percentage
A	80-100	57	0.5%
B	60-79	4096	37.3%
C	40-59	5561	50.6%
D	20-39	1169	10.6%
F	0-19	101	0.9%

Only a tiny fraction—0.5%—of WordPress sites achieved an ‘A’ grade, indicating excellent maintenance. The vast majority, 50.6%, received a ‘C’, suggesting average but often insufficient attention to critical updates and configurations. More alarmingly, 10.6% received a ‘D’ and 0.9% an ‘F’, representing sites with significant to critical maintenance neglect. These sites are likely running outdated core versions, plugins, or themes, making them highly susceptible to known vulnerabilities that could lead to full compromise.

Popularity vs. Security: Top Plugins and Themes

The ecosystem of WordPress plugins and themes is a double-edged sword: it offers incredible functionality but also expands the attack surface. Our scan identified the most prevalent plugins and themes:

Top 10 WordPress Plugins Found

Plugin Name	Installations
Contact Form 7	3152
Elementor	3070
Elementor Pro	1783
Revslider	1055
Complianz Gdpr	1033
Cookie Notice	852
Woocommerce	837
Wp Rocket	748
Js_composer	726
Pojo Accessibility	661

This list includes highly popular and powerful plugins. While invaluable, plugins like Revslider (1055 installations) have a well-documented history of critical vulnerabilities. When combined with the high percentage of sites receiving low maintenance scores, the risk becomes clear: popular plugins, if not diligently updated, become significant entry points for attackers. Similarly, widely used themes such as hello-elementor (1059), Divi (951), and astra (611), if unpatched, can introduce vulnerabilities.

Top 5 WordPress Themes Found

• hello-elementor (1059)
• Divi (951)
• astra (611)
• twentyseventeen (287)
• oceanwp (201)

Geographic Footprint and Emerging Threats

Our scan covered a global footprint, with a notable concentration in:

• France (FR): 18,709 domains
• Chile (CL): 8,743 domains
• United States (US): 1,247 domains
• Spain (ES): 618 domains
• Germany (DE): 281 domains

This distribution underscores the global nature of WordPress usage and, consequently, the global attack surface. Across these diverse regions, our scanner detected 238 phishing sites. This stark number highlights the constant, active threat landscape and the unfortunate reality that many compromised WordPress sites are repurposed for malicious activities, including phishing campaigns.

Performance as a Security Indicator

Our scan also measured the average response time for the domains, clocking in at 1346ms. While not a direct security metric, slow response times can often be indicative of underlying issues that impact security. These can include:

• Outdated infrastructure: Slow sites may run on old server software or hardware, which could have unpatched vulnerabilities.
• Bloated or inefficient code: Poorly optimized themes or plugins can slow down a site and sometimes introduce security flaws.
• Under attack: A slow site could also be experiencing a low-level denial-of-service attack or other resource-intensive malicious activity.

Recommendations for a Hardened WordPress Site

The data from our extensive scan clearly indicates that many WordPress sites are operating with significant, yet preventable, security risks. Here are actionable steps to improve your site’s security posture:

1. Disable XML-RPC if Not Needed: If you don’t use remote publishing tools or pingbacks, disable XML-RPC. This can be done via a plugin or by adding a few lines of code to your .htaccess file or functions.php.
2. Implement Security Headers: Prioritize adding X-Frame-Options, Content Security Policy, and HSTS headers. Many security plugins or server configurations can assist with this.
3. Maintain High Maintenance Scores: Regularly update your WordPress core, themes, and plugins. Enable automatic updates for minor releases and test major updates in a staging environment. Remove any unused themes and plugins.
4. Strong Authentication: Enforce strong, unique passwords for all user accounts and enable Two-Factor Authentication (2FA) for administrators.
5. Use a Web Application Firewall (WAF): A WAF can provide an essential layer of defense, filtering malicious traffic before it reaches your WordPress application.
6. Regular Security Scanning: Proactively scan your site for vulnerabilities, malware, and misconfigurations. This helps you identify and address issues before attackers do.
7. Choose Reputable Hosting: A good host provides a secure server environment, regular backups, and sometimes even built-in WAF capabilities.

Conclusion

Our scan data from 43,960 domains, including 10,984 WordPress sites, reveals a critical need for enhanced security awareness and proactive measures. With nearly half of all WordPress sites exposing XML-RPC, a majority lacking fundamental security headers, and widespread low maintenance scores, the collective attack surface is vast. The detection of 238 phishing sites further underscores the real-world consequences of these vulnerabilities.

Securing a WordPress site isn’t a one-time task; it’s an ongoing commitment. By addressing exposed XML-RPC, implementing robust security headers, and diligently maintaining your site, you can significantly reduce your risk profile and protect your digital assets.

Don’t let your WordPress site become another statistic. Take control of your security posture today. Visit heypulso.com for a free, comprehensive scan and uncover your vulnerabilities before attackers do.