Skip to content
  • Solutions
    By Role
    • For Developers
    • For Content Managers
    • For Agencies
    • For IT Admins
    • For Web Hosters
    • For Developers
    • For Content Managers
    • For Agencies
    • For IT Admins
    • For Web Hosters
    By Infrastructure
    • Overview
    • AWS
    • Microsoft Azure
    • Alibaba Cloud
    • Google Cloud Platform
    • Vultr
    • Overview
    • AWS
    • Microsoft Azure
    • Alibaba Cloud
    • Google Cloud Platform
    • Vultr
    • Digital Ocean
    • Linode
    • Upcloud
    • Oracle
    • OVH
    • Digital Ocean
    • Linode
    • Upcloud
    • Oracle
    • OVH
  • Product
    • Plesk Features
    • Plesk Editions
    • What’s new
    • Pricing
    • Roadmap
    • Lifecycle Policy
    • Extensions Catalogue
  • Pricing
  • Extensions
    Featured Extensions
    • SocialBee
    • WP Toolkit
    • Sitejet Builder for Plesk
    • SEO Toolkit
    • Joomla! Toolkit
    • Premium Email
    • Email Security
    • SocialBee
    • WP Toolkit
    • Sitejet Builder for Plesk
    • SEO Toolkit
    • Joomla! Toolkit
    • Premium Email
    • Email Security
    Bundles and packs:
    • Business and Collaboration Edition
    • WP pack
    • Hosting pack
    • Power pack
    • Language pack
    • Business and Collaboration Edition
    • WP pack
    • Hosting pack
    • Power pack
    • Language pack

    See all Extensions

  • For Partners
    • Plesk Contributor Program
    • Plesk Partner Program
    • Affiliate program
    • Plesk University
  • Help Center
    • Documentation
    • Professional Services
    • Support
    • Contact Us
    • Wiki
    • Forum
  • Plesk 360 login
  • Free Trial
  • Pricing
  • Solutions
    • By Role
      • For Developers
      • For Content Managers
      • For Agencies
      • For IT Admins
      • For Web Hosters
    • By Infrastructure
      • Overview
      • Plesk on Amazon Web Services (AWS & Lightsail)
      • Microsoft Azure
      • Alibaba Cloud
      • Google Cloud Platform
      • Vultr
      • DigitalOcean
      • Linode
      • UpCloud
      • Oracle
      • OVH
  • Products
  • Pricing
  • Extensions
    • Featured Extensions
      • SocialBee
      • WP Toolkit
      • Sitejet Builder for Plesk
      • SEO Toolkit
      • Joomla! Toolkit
      • Premium Email
      • Email Security
    • Bundles and packs:
      • Business and Collaboration Edition
      • WP pack
      • Hosting pack
      • Power pack
      • Language pack
      • See all Extensions
  • For Partners
    • Plesk Contributor Program
    • Plesk Partner Program
    • Affiliate Program
    • Plesk University
  • Help Center
    • Documentation
    • Professional Services
    • Support
    • Contact Us
    • Wiki
    • Forum
  • Plesk 360 login
  • Free Trial
  • Pricing
  • Solutions
    • By Role
      • For Developers
      • For Content Managers
      • For Agencies
      • For IT Admins
      • For Web Hosters
    • By Infrastructure
      • Overview
      • Plesk on Amazon Web Services (AWS & Lightsail)
      • Microsoft Azure
      • Alibaba Cloud
      • Google Cloud Platform
      • Vultr
      • DigitalOcean
      • Linode
      • UpCloud
      • Oracle
      • OVH
  • Products
  • Pricing
  • Extensions
    • Featured Extensions
      • SocialBee
      • WP Toolkit
      • Sitejet Builder for Plesk
      • SEO Toolkit
      • Joomla! Toolkit
      • Premium Email
      • Email Security
    • Bundles and packs:
      • Business and Collaboration Edition
      • WP pack
      • Hosting pack
      • Power pack
      • Language pack
      • See all Extensions
  • For Partners
    • Plesk Contributor Program
    • Plesk Partner Program
    • Affiliate Program
    • Plesk University
  • Help Center
    • Documentation
    • Professional Services
    • Support
    • Contact Us
    • Wiki
    • Forum
  • Plesk 360 login
  • Free Trial
Plesk 360 login
Free Trial

Knowledge Base

WordPress website displays error 403 intermittently: access forbidden by rule request: “POST /xmlrpc.php on Plesk server

 
403 errorapacheapplications extensionsgohosted

Symptoms

  • A WP website displays a 403 error intermittently
  • The following errors are present within the nginx error log for the website:

    2023/07/20 10:40:09 [error] 3925966#0: *145240 access forbidden by rule, client: 203.0.113.2, server: example.com, request: "POST /xmlrpc.php HTTP/2.0", host: "www.example.com"
    2023/07/20 10:44:25 [error] 3925966#0: *145353 access forbidden by rule, client: 203.0.113.2, server: example.com, request: "POST /xmlrpc.php HTTP/2.0", host: "www.example.com"

  • The Block access to xmlrpc.php security feature is enabled for this website via Plesk > WP Toolkit > example.com > three dots > Check Security > Security Measures:

Cause

This specific WordPress website seems to require the xmlrpc.php file to be accessible in order to function properly. Since xmlrpc.php in WordPress installations is a severely outdated file that is essentially a vulnerability, the WP Toolkit in Plesk has a security measure prevents access to the xmlrpc.php file.

It is recommended to apply it to reduce attack surface, if XML-RPC is not used by WordPress. This measure modifies the server configuration file (Apache, nginx for Linux or web.config for Windows).

Note: Custom directives in the .htaccess or web.config files might override this security measure.

Resolution

If your WordPress website needs to use the xmlrpc.php file in order to function properly, you should do the following:

1. Log into Plesk

2. Go to WordPress > example.com > > Check Security > Security Measures

3. Check the box for the Block access to xmlrpc.php security feature

4. Press the Revert button

Once this security measure is disabled, the xmlrpc.php of the WordPress installation will be accessible once again.

Additional Information

How to disable XML-RPC for a WordPress instance hosted in Plesk?

Tweet
Share
Share
Email
0 Shares
Read the full article
Related Posts

How to Host a Go App on Plesk

Read More »

Your Complete .htaccess Guide: Including .htaccess Basics and More

Read More »

NGINX vs Apache – Which Is the Best Web Server in 2024?

Read More »
Knowledge Base

WP Toolkit Cloning hangs or stops after 60 seconds on a Plesk server

Read More »

Duplicate entries in Plesk WP Toolkit: nginx: [emerg] duplicate location “/fake-hotlink-stub”

Read More »

Unable to clone WordPress instance in WP Toolkit : PHP Fatal error: Uncaught Error: Class “WP_Upgrader_Skin” not found

Read More »

Can’t install plugin via WP Toolkit: destination folder already exists

Read More »

Hosting Wiki

  • Django
  • Content Security Policy ( CSP )
  • Server Redundancy
  • Linux Containers
  • Google Cloud CDN
  • AMP
  • htaccess
  • Bare Metal Server
  • PhpMyAdmin
  • phpPgAdmin
  • Oracle VM Server
  • Server Virtualization Software
  • Windows Server
  • Linux
  • PHP
  • MongoDB
  • HTTP/3
  • HTTP/2
  • Joomla! Toolkit
  • WP Toolkit
  • WordPress
  • Plesk
  • Lighttpd
  • Apache Tomcat
  • NGINX
  • Apache
  • Web Server
  • DNS Server
  • HTTP
X-twitter Linkedin Youtube Reddit Github
  • Product
  • Login
  • Pricing
  • Editions
  • For Partners
  • Partner Program
  • Contributor Program
  • Affiliate Program
  • Plesk University
  • Company
  • Blog
  • Careers
  • Events
  • About Plesk
  • Our Brand
  • Resources
  • User and Admin guides
  • Help Center
  • Migrate to Plesk
  • Contact Us
  • Hosting Wiki
  • Forum
  • Legal
  • Legal
  • Privacy Policy
  • Imprint

© 2025 WebPros International GmbH

Part of the WebPros®  Family