{"id":2415,"date":"2026-10-02T10:00:00","date_gmt":"2026-10-02T07:00:00","guid":{"rendered":"https:\/\/narhost.com\/destek\/?p=2415"},"modified":"2026-09-27T00:02:13","modified_gmt":"2026-09-26T21:02:13","slug":"wordpress-xml-rpc-kapatma","status":"publish","type":"post","link":"https:\/\/narhost.com\/destek\/wordpress-xml-rpc-kapatma\/","title":{"rendered":"WordPress XML-RPC Nas\u0131l Kapat\u0131l\u0131r (xmlrpc.php Engelleme)"},"content":{"rendered":"<p class=\"kb-dogrulama\">Son g\u00f6zden ge\u00e7irme: Eyl\u00fcl 2026 \u00b7 cPanel 136 test hesab\u0131 ekranlar\u0131 ve WordPress resm\u00ee dok\u00fcman\u0131na g\u00f6re<\/p>\n<div id=\"hizli-cozum\" class=\"ai-box ai-box--cozum\">\n<p class=\"ai-box-title\">H\u0131zl\u0131 \u00e7\u00f6z\u00fcm<\/p>\n<p><strong>WordPress XML-RPC kapatma<\/strong> i\u015fleminin en sa\u011flam yolu, <code>xmlrpc.php<\/code> dosyas\u0131na eri\u015fimi <code>.htaccess<\/code> ile engellemektir; b\u00f6ylece bu dosya \u00fczerinden yap\u0131lan \u015fifre denemeleri ve pingback istekleri WordPress&#8217;e hi\u00e7 ula\u015fmaz.<\/p>\n<ol>\n<li>Jetpack, eski mobil uygulama ya da uzaktan yay\u0131n arac\u0131 kullan\u0131p kullanmad\u0131\u011f\u0131n\u0131z\u0131 kontrol edin.<\/li>\n<li>cPanel Dosya Y\u00f6neticisi&#8217;nde <code>public_html\/.htaccess<\/code> dosyas\u0131n\u0131n yede\u011fini al\u0131n.<\/li>\n<li>Dosyan\u0131n en \u00fcst\u00fcne <code>xmlrpc.php<\/code> i\u00e7in eri\u015fim engeli ekleyin.<\/li>\n<li><code>https:\/\/ornek.com\/xmlrpc.php<\/code> adresinin 403 d\u00f6nd\u00fc\u011f\u00fcn\u00fc do\u011frulay\u0131n.<\/li>\n<\/ol>\n<\/div>\n<table class=\"kb-uyg\">\n<tr>\n<th>Panel<\/th>\n<td>cPanel, WordPress y\u00f6netim paneli<\/td>\n<\/tr>\n<tr>\n<th>Sistem<\/th>\n<td>Payla\u015f\u0131ml\u0131 hosting (CloudLinux, LiteSpeed)<\/td>\n<\/tr>\n<tr>\n<th>Yetki<\/th>\n<td>cPanel kullan\u0131c\u0131s\u0131<\/td>\n<\/tr>\n<tr>\n<th>Narhost \u00fcr\u00fcn\u00fc<\/th>\n<td><a href=\"https:\/\/narhost.com\/wordpress-hosting\" title=\"WordPress Hosting paketleri \u2014 Narhost\">WordPress Hosting<\/a><\/td>\n<\/tr>\n<\/table>\n<div class=\"kb-once\">\n<p class=\"label\">Ba\u015flamadan \u00f6nce<\/p>\n<ul>\n<li>Dosya Y\u00f6neticisi&#8217;nde gizli dosyalar\u0131n g\u00f6r\u00fcn\u00fcr oldu\u011fundan emin olun; <code>.htaccess<\/code> nokta ile ba\u015flad\u0131\u011f\u0131 i\u00e7in varsay\u0131lan olarak gizlenebilir.<\/li>\n<li><code>.htaccess<\/code> dosyas\u0131n\u0131 d\u00fczenlemeden \u00f6nce bilgisayar\u0131n\u0131za indirin.<\/li>\n<li>Siteye ba\u011fl\u0131 harici servislerin listesini \u00e7\u0131kar\u0131n (Jetpack, yay\u0131n ara\u00e7lar\u0131, mobil uygulama).<\/li>\n<\/ul>\n<\/div>\n<h2>XML-RPC ne i\u015fe yarar, neden kapat\u0131l\u0131r<\/h2>\n<p><code>xmlrpc.php<\/code>, WordPress&#8217;e uzaktan yaz\u0131 g\u00f6nderme, d\u00fczenleme ve pingback alma i\u015flerini yapan eski bir aray\u00fczd\u00fcr; destekledi\u011fi y\u00f6ntemler <a href=\"https:\/\/developer.wordpress.org\/apis\/xml-rpc\/\" title=\"XML-RPC \u2014 WordPress Common APIs Handbook\" target=\"_blank\" rel=\"noopener\">WordPress geli\u015ftirici el kitab\u0131nda<\/a> listelenir. REST API ve uygulama \u015fifreleri geldikten sonra \u00e7o\u011fu ara\u00e7 o yola ge\u00e7ti; bug\u00fcn XML-RPC&#8217;ye ba\u011fl\u0131 kalanlar genelde Jetpack&#8217;in baz\u0131 i\u015flevleri, eski s\u00fcr\u00fcm mobil uygulamalar ve birka\u00e7 masa\u00fcst\u00fc yay\u0131n arac\u0131d\u0131r.<\/p>\n<p>Kullan\u0131lmayan XML-RPC ise botlar i\u00e7in <code>wp-login.php<\/code> d\u0131\u015f\u0131nda ikinci bir giri\u015f kap\u0131s\u0131d\u0131r. G\u00fcncel s\u00fcr\u00fcmler tek istekte birden \u00e7ok \u015fifre denemesini s\u0131n\u0131rlasa da bu dosyaya gelen yo\u011fun POST istekleri sunucu kayna\u011f\u0131n\u0131 t\u00fcketir. <code>pingback.ping<\/code> y\u00f6ntemi ise sitenizi ba\u015fka sitelere istek yans\u0131tan bir araca d\u00f6n\u00fc\u015ft\u00fcrebilir. Eri\u015fim kay\u0131tlar\u0131nda <code>POST \/xmlrpc.php<\/code> sat\u0131rlar\u0131 \u00e7o\u011fal\u0131yorsa kapatma zaman\u0131 gelmi\u015ftir.<\/p>\n<h2>WordPress XML-RPC kapatma ad\u0131mlar\u0131<\/h2>\n<h3>Y\u00f6ntem 1 \u2014 .htaccess ile tam engelleme (\u00f6nerilen)<\/h3>\n<ol class=\"kb-adimlar\">\n<li><strong>cPanel \u2192 Dosyalar \u2192 Dosya Y\u00f6neticisi<\/strong> ile <code>public_html<\/code> klas\u00f6r\u00fcn\u00fc a\u00e7\u0131n. <code>.htaccess<\/code> g\u00f6r\u00fcnm\u00fcyorsa sa\u011f \u00fcstteki Ayarlar&#8217;dan gizli dosyalar\u0131 g\u00f6ster se\u00e7ene\u011fini i\u015faretleyin.<br \/>\n<figure class=\"kb-ekran\"><img decoding=\"async\" src=\"https:\/\/narhost.com\/destek\/wp-content\/uploads\/2026\/09\/wordpress-xml-rpc-kapatma-adim-1-1.webp\" alt=\"WordPress XML-RPC kapatma i\u00e7in cPanel Dosya Y\u00f6neticisi'nde public_html ve .htaccess dosyas\u0131\" width=\"1200\" height=\"833\" loading=\"lazy\"><figcaption>Dosya Y\u00f6neticisi; gizli dosyalar Ayarlar penceresinden g\u00f6r\u00fcn\u00fcr yap\u0131l\u0131r, .htaccess D\u00fczenle ile a\u00e7\u0131l\u0131r.<\/figcaption><\/figure>\n<p class=\"kb-cikti\">Beklenen sonu\u00e7: <code>.htaccess<\/code> dosya listesinde g\u00f6r\u00fcn\u00fcr.<\/p>\n<\/li>\n<li><strong><code>.htaccess<\/code> dosyas\u0131n\u0131 se\u00e7ip D\u00fczenle ile a\u00e7\u0131n<\/strong> ve en \u00fcste, <code># BEGIN WordPress<\/code> sat\u0131r\u0131n\u0131n \u00fcst\u00fcne \u015fu blo\u011fu ekleyin. WordPress i\u015faretler aras\u0131ndaki b\u00f6l\u00fcm\u00fc kal\u0131c\u0131 ba\u011flant\u0131 ayar\u0131nda yeniden yazd\u0131\u011f\u0131 i\u00e7in blok d\u0131\u015far\u0131da kalmal\u0131.\n<pre><code class=\"language-apache\"># XML-RPC eri\u015fimini kapat\n&lt;Files xmlrpc.php&gt;\n    Require all denied\n&lt;\/Files&gt;<\/code><\/pre>\n<p class=\"kb-cikti\">Beklenen sonu\u00e7: dosya kaydedilir, site a\u00e7\u0131lmaya devam eder.<\/p>\n<\/li>\n<\/ol>\n<h3>Y\u00f6ntem 2 \u2014 Filtre ile k\u0131smi kapatma<\/h3>\n<p>Dosyaya eri\u015fimi a\u00e7\u0131k b\u0131rak\u0131p WordPress i\u00e7inden kapatmak istiyorsan\u0131z alt teman\u0131n <code>functions.php<\/code> dosyas\u0131na ya da bir kod par\u00e7ac\u0131\u011f\u0131 eklentisine \u015fu sat\u0131rlar\u0131 ekleyin; kod ekleme yollar\u0131 <a href=\"https:\/\/narhost.com\/destek\/wordpress-siteye-kod-ekleme\/\" title=\"WordPress Siteye Kod Ekleme \u2014 Narhost Destek\">WordPress siteye kod ekleme<\/a> kart\u0131nda.<\/p>\n<pre><code class=\"language-php\">add_filter( 'xmlrpc_enabled', '__return_false' );\nadd_filter( 'xmlrpc_methods', function ( $methods ) {\n    unset( $methods['pingback.ping'] );\n    return $methods;\n} );<\/code><\/pre>\n<p>\u0130lk sat\u0131r yaln\u0131z kimlik do\u011frulama isteyen y\u00f6ntemleri kapat\u0131r; <a href=\"https:\/\/developer.wordpress.org\/reference\/hooks\/xmlrpc_enabled\/\" title=\"xmlrpc_enabled filtresi \u2014 WordPress Developer Resources\" target=\"_blank\" rel=\"noopener\">resm\u00ee dok\u00fcmana g\u00f6re<\/a> pingback bu filtreden etkilenmez, bu y\u00fczden ikinci filtre <code>pingback.ping<\/code> y\u00f6ntemini ayr\u0131ca kald\u0131r\u0131r. Bu y\u00f6ntemde istek yine PHP&#8217;yi \u00e7al\u0131\u015ft\u0131r\u0131r, yani y\u00fck azalmaz; y\u00fck sorunu varsa Y\u00f6ntem 1&#8217;i se\u00e7in.<\/p>\n<div class=\"warn-box\">\n<p class=\"label\">Kapat\u0131nca ne bozulur<\/p>\n<p>Jetpack ba\u011flant\u0131s\u0131, XML-RPC kullanan eski mobil uygulama s\u00fcr\u00fcmleri ve uzaktan yay\u0131n ara\u00e7lar\u0131 \u00e7al\u0131\u015fmay\u0131 b\u0131rak\u0131r. Bunlardan birini kullan\u0131yorsan\u0131z XML-RPC&#8217;yi kapatmak yerine giri\u015f denemelerini s\u0131n\u0131rlay\u0131n.<\/p>\n<\/div>\n<h2>Do\u011frulama<\/h2>\n<div class=\"success-box\">\n<p class=\"label\">Sonu\u00e7<\/p>\n<p>Taray\u0131c\u0131da <code>https:\/\/ornek.com\/xmlrpc.php<\/code> adresini a\u00e7\u0131n. Y\u00f6ntem 1&#8217;den sonra sayfa 403 Forbidden d\u00f6ner. Kapatmadan \u00f6nce ayn\u0131 adres <code>XML-RPC server accepts POST requests only.<\/code> metnini g\u00f6sterir. Y\u00f6ntem 2&#8217;de bu metin g\u00f6r\u00fcnmeye devam eder; kimlik isteyen bir \u00e7a\u011fr\u0131 ise <code>XML-RPC services are disabled on this site.<\/code> yan\u0131t\u0131 al\u0131r. Birka\u00e7 g\u00fcn sonra eri\u015fim kay\u0131tlar\u0131nda <code>xmlrpc.php<\/code> isteklerinin 403 ile bitti\u011fini g\u00f6rebilirsiniz.<\/p>\n<\/div>\n<h2>H\u00e2l\u00e2 \u00e7\u00f6z\u00fclmediyse<\/h2>\n<ul>\n<li><strong>Kaydettikten sonra site 500 hatas\u0131 veriyor.<\/strong><code>.htaccess<\/code> i\u00e7inde yaz\u0131m hatas\u0131 var; indirdi\u011finiz yede\u011fi geri y\u00fckleyip blo\u011fu yeniden, sat\u0131r sat\u0131r ekleyin.<\/li>\n<li><strong>Giri\u015f denemeleri <code>wp-login.php<\/code> \u00fczerinden s\u00fcr\u00fcyor.<\/strong> XML-RPC&#8217;yi kapatmak oradaki sald\u0131r\u0131y\u0131 durdurmaz; <a href=\"https:\/\/narhost.com\/destek\/imunify360-brute-force-koruma\/\" title=\"Brute Force Sald\u0131r\u0131lar\u0131n\u0131 Imunify360 ile Nas\u0131l Engellersiniz \u2014 Narhost Destek\">Imunify360 brute force korumas\u0131<\/a> kart\u0131ndaki ayarlar\u0131 uygulay\u0131n.<\/li>\n<li><strong>Kod yazmadan y\u00f6netmek istiyorum.<\/strong> \u00c7o\u011fu g\u00fcvenlik eklentisinde XML-RPC anahtar\u0131 vard\u0131r; se\u00e7im i\u00e7in <a href=\"https:\/\/narhost.com\/destek\/wordpress-guvenlik-eklentileri-ile-site-korumasi-nasil-yapilir\/\" title=\"WordPress G\u00fcvenlik Eklentileri ile Site Korumas\u0131 Nas\u0131l Yap\u0131l\u0131r \u2014 Narhost Destek\">WordPress g\u00fcvenlik eklentileri<\/a> kart\u0131na bak\u0131n.<\/li>\n<\/ul>\n<div class=\"cta-box\">\n<p class=\"label\">Narhost deste\u011fi<\/p>\n<p>Talebe \u015funlar\u0131 ekleyin: alan ad\u0131n\u0131z, <code>.htaccess<\/code> dosyas\u0131na ekledi\u011finiz sat\u0131rlar, g\u00f6rd\u00fc\u011f\u00fcn\u00fcz hata metni birebir ve sorunun ba\u015flad\u0131\u011f\u0131 saat.<\/p>\n<p><a class=\"cta-btn\" href=\"https:\/\/narhost.com\/submitticket.php\" title=\"Narhost destek talebi a\u00e7\">Destek talebi a\u00e7<\/a><\/div>\n<div class=\"kb-ilgili\">\n<p class=\"label\">Sonraki ad\u0131mlar<\/p>\n<ul>\n<li><a href=\"https:\/\/narhost.com\/destek\/wordpress-sorunlari-ve-cozumleri\/\" title=\"WordPress Y\u00f6netimi ve Sorun Giderme Rehberi \u2014 Narhost Destek\">WordPress y\u00f6netimi ve sorun giderme rehberi<\/a><\/li>\n<li><a href=\"https:\/\/narhost.com\/destek\/imunify360-brute-force-koruma\/\" title=\"Brute Force Sald\u0131r\u0131lar\u0131n\u0131 Imunify360 ile Nas\u0131l Engellersiniz \u2014 Narhost Destek\">Imunify360 ile brute force korumas\u0131<\/a><\/li>\n<li><a href=\"https:\/\/narhost.com\/blog\/wordpress-guvenlik-eklentisi-nasil-secilir\/\" title=\"WordPress G\u00fcvenlik Eklentisi Se\u00e7imi \u2014 Narhost Blog\">WordPress g\u00fcvenlik eklentisi nas\u0131l se\u00e7ilir<\/a><\/li>\n<\/ul>\n<\/div>\n<div class=\"kb-faq\">\n<h2>S\u0131k\u00e7a sorulan sorular<\/h2>\n<h3>WordPress XML-RPC kapatma REST API&#8217;yi de kapat\u0131r m\u0131?<\/h3>\n<p>Hay\u0131r. REST API <code>\/wp-json\/<\/code> alt\u0131nda ayr\u0131 \u00e7al\u0131\u015f\u0131r; blok d\u00fczenleyici de bu aray\u00fcz\u00fc kullan\u0131r ve etkilenmez.<\/p>\n<h3>Jetpack kullan\u0131yorum, XML-RPC&#8217;yi kapatabilir miyim?<\/h3>\n<p>Tamamen kapat\u0131rsan\u0131z Jetpack ba\u011flant\u0131s\u0131 kopar. Bu durumda XML-RPC&#8217;yi a\u00e7\u0131k b\u0131rak\u0131p giri\u015f denemelerini g\u00fcvenlik katman\u0131nda s\u0131n\u0131rlay\u0131n.<\/p>\n<h3>Pingback&#8217;leri ayr\u0131ca kapatmam gerekir mi?<\/h3>\n<p>Y\u00f6ntem 1 b\u00fct\u00fcn dosyay\u0131 engelledi\u011fi i\u00e7in gerekmez. Y\u00f6ntem 2&#8217;de ikinci filtre bu i\u015fi g\u00f6r\u00fcr.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>WordPress XML-RPC kapatma rehberi: XML-RPC ne i\u015fe yarar, brute force ve pingback riski, .htaccess ile tam engelleme, xmlrpc_enabled filtresiyle k\u0131smi kapatma ve do\u011frulama.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[79,7],"tags":[179],"class_list":["post-2415","post","type-post","status-publish","format-standard","hentry","category-guvenlik-duvari","category-wordpress-hosting","tag-guvenlik-2"],"meta_box":[],"_links":{"self":[{"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/posts\/2415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/comments?post=2415"}],"version-history":[{"count":1,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/posts\/2415\/revisions"}],"predecessor-version":[{"id":2814,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/posts\/2415\/revisions\/2814"}],"wp:attachment":[{"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/media?parent=2415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/categories?post=2415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/tags?post=2415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}