Secure XML-RPC
Rather than sending usernames and passwords in plain text with every request, we’re going to use a set of public/secret keys to hash data and authenticate instead. On your WordPress profile, you will see a new “Remote Publishing Permissions” section listing out the applications that have permission
Rather than sending usernames and passwords in plain text with every request, we’re going to use a set of public/secret keys to hash data and authenticate instead.
On your WordPress profile, you will see a new “Remote Publishing Permissions” section listing out the applications that have permission to publish, along with their public and secret keys.
New applications can be added whenever you want. You can also change the names of applications, or revoke publishing permission by deleting them.
Additional Information
Lock graphic designed by Scott Lewis from the thenounproject.com
A closer look.
Manual Installation
- 01Upload the entire /secure-xml-rpc directory to the /wp-content/plugins/ directory.
- 02Activate Secure XML-RPC through the ‘Plugins’ menu in WordPress.
Frequently asked questions.
How do I use the new authorization?
The old username/password paradigm can still be used, but will result in a X-Deprecated header being returned by the server.
From now on, you will send an Authorization header. This header will be the publishing application’s public key, two pipe ( | ) characters, and a hash of the application’s secret key concatenated with the body of the request.
How do I generate the message hash?
Say your application has the following information: * Public Key: b730db0864b0d4453ba6a26ad6613cd4 * Secret Key: 7647a19f5bf3e9fd001419900ad48a54
And you want to make the following request (whitespace/indentation added for readability, but is removed when calculating hashes):
<?xml version="1.0"?> <methodCall> <methodName>wp.getPosts</methodName> <params> <param> <value><i4>1</i4></value> </param> <param> <value><string></string></value> </param> <param> <value><string></string></value> </param> </params> </methodCall>
