Even though in the past, many consultants (including myself) used to recommend Jetpack for WordPress, there is a very important reason now to remove it from your WordPress website. The reason is because Jetpack sadly requires XML-RPC, which makes your website much more susceptible to potential hacks. Last week, I spent a few hours removing Jetpack from the very few old websites I personally maintain that still had Jetpack installed. The tedious part wasn’t the 2-clicks required to uninstall Jetpack. The tedious part was re-creating and re-installing the contact forms that used to be handled by Jetpack on some of those older websites. Nowadays, I always create contact forms together with Cloudflare Turnstile, the best way I know to prevent non-human form spam. You may remember that I reviewed Turnstile back in 2024. Fortunately, at least two free or freemium contact forms now support Turnstile directly, without any additional plugin to make Turnstile integration possible within the form. These are Contact Form 7 and WPForms.
After replacing the contact forms (which can be several on bilingual or multilingual websites, as was the case with some of the ones I recently replaced), adding the Cloudflare Turnstile and testing the forms, you can then celebrate by:
- Uninstalling Jetpack.
- Disabling XML-RPC using your current or upcoming security plugin.
After that, it will also be a good idea to disable App Login (Rest API), disable REST Endpoint within your security plugin and hide (i.e. relocate) your login page, if you haven’t already done these three things, unless you know you have a very good reason to maintain them active.
Important note if you are using Wordfence as your security plugin
Wordfence does not provide a direct option to entirely disable the WordPress REST API, as its own functionality, including Wordfence Central, relies on it. You might want to consider another security plugin like FluentAUTH especially if your web server already includes Imunify360 as all plans from my TecnoTur.LLC do.
A reason why you may need to maintain XML-RPC
If you are using VideoPress from Jetpack, then my research indicates that you need to maintain XML-RPC, despite its security risk.
This is fortunately not the case if you are using Vimeo or Bunny Stream for your embedded videos. See my Bunny Stream review here:
Review: Bunny Stream beats Vimeo Pro for 4 reasons-at least (illustrated above)
I continue to recommend Bunny Stream for the four reasons covered in that article.
Upcoming 3rd edition of my ebook WordPress security + multi-backups
The upcoming 3rd edition of my ebook WordPress security + multi-backups will include the information covered in this article and much more. The 3rd edition will be a free download for all purchasers of the first and second editions. If you purchased your copy outside of the direct website (YourWebsiteSecurity.com), please request your free 3rd edition (to be granted when available) via this contact form. Be prepared to provide a receipt of your original purchase, if requested in the email response to your request.
Leer este artículo en buen castellano
Jetpack: Un buen motivo para eliminarlo de tu sitio web WordPress
(Re-)Subscribe for upcoming articles, reviews, radio shows, books and seminars/webinars
Stand by for upcoming articles, reviews, books and courses by subscribing to my bulletins.
In English:
- Email bulletins, bulletins.AllanTepper.com
- In Telegram, t.me/TecnoTurBulletins
- Twitter (bilingual), AllanLTepper
En castellano:
- Boletines por correo electrónico, boletines.AllanTepper.com
- En Telegram, t.me/boletinesdeAllan
- Twitter (bilingüe), AllanLTepper
Most of my current books are at books.AllanTepper.com, and also visit AllanTepper.com and radio.AllanTepper.com.
FTC disclosure
None of the listed individuals or companies mentioned above has paid for this article. Allan Tépper earns royalties on the sales of his own books. Some of the manufacturers listed above have contracted Tépper and/or TecnoTur LLC to carry out consulting and/or translations/localizations/transcreations. So far, none of the manufacturers listed above is/are sponsors of the TecnoTur, BeyondPodcasting, CapicúaFM or TuSaludSecreta programs, although they are welcome to do so, and some are, may be (or may have been) sponsors of ProVideo Coalition magazine. Some links to third parties listed in this article and/or on this web page may indirectly benefit TecnoTur LLC via affiliate programs. Allan Tépper’s opinions are his own. Allan Tépper is not liable for misuse or misunderstanding of information he shares.