Title: Secure XML-RPC
Author: Eric Mann
Published: јануари 1, 2014
Last modified: август 30, 2014
---
Search plugins
This plugin **hasn’t been tested with the latest 3 major releases of WordPress**.
It may no longer be maintained or supported and may have compatibility issues when
used with more recent versions of WordPress.
# Secure XML-RPC
By [Eric Mann](https://profiles.wordpress.org/ericmann/)
[Download](https://downloads.wordpress.org/plugin/secure-xml-rpc.1.0.0.zip)
* [Details](https://mk.wordpress.org/plugins/secure-xml-rpc/#description)
* [Reviews](https://mk.wordpress.org/plugins/secure-xml-rpc/#reviews)
* [Installation](https://mk.wordpress.org/plugins/secure-xml-rpc/#installation)
* [Development](https://mk.wordpress.org/plugins/secure-xml-rpc/#developers)
[Support](https://wordpress.org/support/plugin/secure-xml-rpc/)
## Description
Rather than sending usernames and passwords in plain text with every request, we’re
going to use a set of public/secret keys to hash data and authenticate instead.
On your WordPress profile, you will see a new “Remote Publishing Permissions” section
listing out the applications that have permission to publish, along with their public
and secret keys.
New applications can be added whenever you want. You can also change the names of
applications, or revoke publishing permission by deleting them.
### Additional Information
Lock graphic designed by Scott Lewis from the thenounproject.com
## Screenshots
* [[
* The new Remote Publishing Permissions area of the user profile.
## Installation
#### Manual Installation
1. Upload the entire `/secure-xml-rpc` directory to the `/wp-content/plugins/` directory.
2. Activate Secure XML-RPC through the ‘Plugins’ menu in WordPress.
## FAQ
How do I use the new authorization?
The old username/password paradigm can still be used, but will result in a `X-Deprecated`
header being returned by the server.
From now on, you will send an `Authorization` header. This header will be the publishing
application’s public key, two pipe (`|`) characters, and a hash of the application’s
secret key concatenated with the body of the request.
How do I generate the message hash?
Say your application has the following information:
* Public Key: b730db0864b0d4453ba6a26ad6613cd4*
Secret Key: 7647a19f5bf3e9fd001419900ad48a54
And you want to make the following request (whitespace/indentation added for readability,
but is removed when calculating hashes):
```
wp.getPosts
1
```
Note that the second and third parameters (traditionally `username` and `password`)
are empty. Usernames and passwords can still be specified, but will result in the
server returning an `X-Deprecated` header.
Your Authorization header would thus become:
```
b730db0864b0d4453ba6a26ad6613cd4||3fac15f99f7a178f922bcc4942e62dc9001b2a45118fc3a6f3aebd77d25f4d58
```
The second part of the header is generated in PHP by calculating:
```
hash( 'sha256', '7647a19f5bf3e9fd001419900ad48a54' . hash( 'sha256', '7647a19f5bf3e9fd001419900ad48a54' . {request_body} ) )
```
WordPress will read the header and log you in as usual, but you never need to send
your password across the wire.
In this paradigm, application secret keys should _also_ be treated as passwords –
they are sensitive information!
Why are we using the secret key twice?
Some developers raised concerns about [length extension attacks](https://blog.whitehatsec.com/hash-length-extension-attacks/)
in previous editions of the plugin. While length extension isn’t strictly necessary
when dealing with XML-based messaging, a double hash helps end the discussion around
potentially-related vulnerabilities.
The double-hash is similar to but simpler than HMAC and is fairly easy to implement
in any programming language. Just note, PHP’s `hash()` function returns a base64-
encoded string, not a raw hash of the data passed in.
Do I have to copy/paste my application keys into remote systems?
Not necessarily.
The latest version of the plugin adds a new XML-RPC method to the system that allows
for the generation of user-specific application keys remotely. _Please only ever
call this method over a secure/trusted network connection_ when setting up an application
for the first time.
## Reviews
### [Secure fail ?](https://wordpress.org/support/topic/secure-fail/)
[Anonymous User 13245058](https://profiles.wordpress.org/anonymized-13245058/)
септември 3, 2016
This plugin has been hacked on a client website…
### [Very useful plugin](https://wordpress.org/support/topic/very-useful-plugin-440/)
[benjib0t](https://profiles.wordpress.org/benjib0t/) февруари 7, 2017
[ Read all 3 reviews ](https://wordpress.org/support/plugin/secure-xml-rpc/reviews/)
## Contributors & Developers
“Secure XML-RPC” is open source software. The following people have contributed
to this plugin.
Contributors
* [ Eric Mann ](https://profiles.wordpress.org/ericmann/)
[Translate “Secure XML-RPC” into your language.](https://translate.wordpress.org/projects/wp-plugins/secure-xml-rpc)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/secure-xml-rpc/), check
out the [SVN repository](https://plugins.svn.wordpress.org/secure-xml-rpc/), or
subscribe to the [development log](https://plugins.trac.wordpress.org/log/secure-xml-rpc/)
by [RSS](https://plugins.trac.wordpress.org/log/secure-xml-rpc/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* New: Add a custom RPC method for generating application keys remotely.
* Dev change: Move all functional implementations inside our pseudo-namespace.
* Dev change: Use a constant-time string comparison method for better security
and less data leakage during authentication.
* Dev change: Use a double-hash to prevent any potential length-extension attacks.
#### 0.1.0
* First release
## Meta
* Version **1.0.0**
* Last updated **12 години ago**
* Active installations **60+**
* WordPress version ** 3.8 or higher **
* Tested up to **4.0.38**
* Language
* [English (US)](https://wordpress.org/plugins/secure-xml-rpc/)
* Tags
* [authentication](https://mk.wordpress.org/plugins/tags/authentication/)[oauth](https://mk.wordpress.org/plugins/tags/oauth/)
[security](https://mk.wordpress.org/plugins/tags/security/)[xmlrpc](https://mk.wordpress.org/plugins/tags/xmlrpc/)
* [Advanced View](https://mk.wordpress.org/plugins/secure-xml-rpc/advanced/)
## Ratings
3.7 out of 5 stars.
* [ 2 5-star reviews ](https://wordpress.org/support/plugin/secure-xml-rpc/reviews/?filter=5)
* [ 0 4-star reviews ](https://wordpress.org/support/plugin/secure-xml-rpc/reviews/?filter=4)
* [ 0 3-star reviews ](https://wordpress.org/support/plugin/secure-xml-rpc/reviews/?filter=3)
* [ 0 2-star reviews ](https://wordpress.org/support/plugin/secure-xml-rpc/reviews/?filter=2)
* [ 1 1-star review ](https://wordpress.org/support/plugin/secure-xml-rpc/reviews/?filter=1)
[Your review](https://wordpress.org/support/plugin/secure-xml-rpc/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/secure-xml-rpc/reviews/)
## Contributors
* [ Eric Mann ](https://profiles.wordpress.org/ericmann/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/secure-xml-rpc/)
## Donate
Would you like to support the advancement of this plugin?
[ Donate to this plugin ](http://wordpress.org/plugins/secure-xmlrpc)