Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the xmlrpc.php file that it is also recommended to remove wlwmanifest.xml (Windows Live Writer Manifest link).

So far as I can tell wlwmanifest.xml does not offer up any WordPress version information, nor does it seem able to be leveraged for testing username/password credentials as xmlrpc.php does.

Most of the content in the sources below states, in summary, "remove code if not using as it is unnecessary."

Can anyone shed some light as to why this file should also be removed/blocked? If this is not a security concern, is this just simply an optimization?

Thank you!

Sources (that suggest removal/block of wlwmanifest.xml):


There's no point in removing it. It's a static file with information on how Windows Live Writer can talk to wordpress.

Discovering that you're running wordpress is usually rather trivial, so nothing much is revealed by this file either.

When it comes to securing WP, focus on staying up to date, via automatic patching.

  • Thanks for your answer- most of my research suggested the same. Accepting this unless anyone has any other information to counter. – waymobetta Jul 18 '18 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.