{"id":1808,"date":"2017-07-18T09:09:15","date_gmt":"2017-07-18T03:39:15","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=1808"},"modified":"2026-08-31T17:17:47","modified_gmt":"2026-08-31T11:47:47","slug":"wordpress-post-xmlrpc-php-attack-prevention","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/wordpress-post-xmlrpc-php-attack-prevention\/","title":{"rendered":"WordPress post: xmlrpc.php attack Prevention"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>xmlrpc.php<\/code> is a WordPress file that enables remote communication between WordPress and external applications or services. While it provides useful functionality, attackers can abuse the XML-RPC endpoint to perform <strong>brute-force login attempts, password-guessing attacks, and other automated requests<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A common indication of an XML-RPC attack is a large number of <code>POST<\/code> requests to <code>\/xmlrpc.php<\/code> appearing in the Nginx access or error logs. In some cases, excessive requests can also consume PHP-FPM resources and affect website performance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This document explains how to identify and prevent unwanted access to <code>xmlrpc.php<\/code> using an <strong>Nginx configuration rule<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before implementing the configuration, ensure the following requirements are met:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Root or sudo access<\/strong> to the server.<\/li>\n\n\n\n<li>Nginx is installed and actively serving the WordPress website.<\/li>\n\n\n\n<li>The WordPress website is running behind Nginx.<\/li>\n\n\n\n<li>Access to the Nginx virtual host\/server configuration.<\/li>\n\n\n\n<li>Basic knowledge of Linux commands.<\/li>\n\n\n\n<li>A backup of the existing Nginx configuration is recommended before making changes.<\/li>\n\n\n\n<li>Confirm whether the website or any required integration actually uses XML-RPC functionality.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Check Nginx status<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">$ systemctl status nginx<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Check the Nginx version<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">$ nginx -v<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Backup the configuration<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">cp \/etc\/nginx\/sites-enabled\/default \/etc\/nginx\/sites-enabled\/default.bak<\/pre>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> If your website uses a separate Nginx virtual-host configuration, modify that configuration instead of <code>\/etc\/nginx\/sites-enabled\/default<\/code>.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Implementation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Identify XML-RPC Requests<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before blocking <code>xmlrpc.php<\/code>, review the Nginx logs and check whether the server is receiving repeated requests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ grep \"xmlrpc.php\" \/var\/log\/nginx\/access.log<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To specifically check <code>POST<\/code> requests:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ grep 'POST \/xmlrpc.php' \/var\/log\/nginx\/access.log<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You may see requests similar to:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">xx.xx.xx.xx &#8211; &#8211; [17\/Jul\/2017:06:25:46] &#8220;POST \/xmlrpc.php HTTP\/1.0&#8221; 200<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Continuous requests from multiple IP addresses can indicate automated scanning or an XML-RPC abuse attempt.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Locate the Nginx Configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The default Nginx configuration is commonly located at:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ \/etc\/nginx\/sites-enabled\/default<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open the configuration:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ vi \/etc\/nginx\/sites-enabled\/default<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If your WordPress website has its own virtual-host configuration, identify it first:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ nginx -T<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then modify the appropriate <code>server {}<\/code> block.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Block <code>xmlrpc.php<\/code><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following configuration <strong>inside the appropriate <code>server {}<\/code> block<\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">location = \/xmlrpc.php {<br>    deny all;<br>}<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">server {<br>    listen 80;<br>    server_name example.com www.example.com;<br><br>    root \/var\/www\/html;<br><br>    location = \/xmlrpc.php {<br>        deny all;<br>    }<br><br>    # Other WordPress configuration...<br>}<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This configuration tells Nginx to deny requests made directly to:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">\/xmlrpc.php<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact-match location:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">location = \/xmlrpc.php<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ensures that the rule specifically applies to the <code>xmlrpc.php<\/code> endpoint.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Test the Nginx Configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before restarting Nginx, always check the configuration syntax:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ nginx -t<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A successful result should look similar to:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">syntax is ok<br>test is successful<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you receive an error, <strong>do not restart Nginx<\/strong> until the configuration issue has been corrected.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Reload Nginx<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If the configuration test is successful, reload Nginx:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ systemctl reload nginx<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ service nginx reload<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A reload is generally preferred because it applies the configuration without unnecessarily terminating existing connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If required, you can restart Nginx:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ systemctl restart nginx<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h5 class=\"wp-block-heading\">Verification<\/h5>\n\n\n\n<h5 class=\"wp-block-heading\">1. Test <code>xmlrpc.php<\/code><\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">From the server or another system, run:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ curl -I https:\/\/example.com\/xmlrpc.php<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The request should return:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTP\/1.1 403 Forbidden<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This confirms that Nginx is denying access to the endpoint.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h5 class=\"wp-block-heading\">2. Test with POST<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">You can also test a POST request:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ curl -X POST https:\/\/example.com\/xmlrpc.php<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The expected result should indicate that access is forbidden.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h5 class=\"wp-block-heading\">3. Check Nginx Logs<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Review the access log:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ grep \"xmlrpc.php\" \/var\/log\/nginx\/access.log<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should see requests returning a <code>403<\/code> status.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">xx.xx.xx.xx &#8211; &#8211; &#8220;POST \/xmlrpc.php HTTP\/1.0&#8221; 403<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This confirms that the request reached Nginx but was blocked by the configured rule.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">Important Considerations<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Before completely disabling XML-RPC, verify whether the website depends on it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some WordPress functionality or third-party integrations may use XML-RPC, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Remote WordPress applications<\/li>\n\n\n\n<li>Certain publishing tools<\/li>\n\n\n\n<li>Legacy integrations<\/li>\n\n\n\n<li>Some plugins and external services<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If XML-RPC is required by the website, completely blocking it may break that functionality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In such cases, consider alternatives such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Restricting access by IP.<\/li>\n\n\n\n<li>Using application-level protection.<\/li>\n\n\n\n<li>Rate limiting XML-RPC requests.<\/li>\n\n\n\n<li>Disabling only specific XML-RPC methods.<\/li>\n\n\n\n<li>Using a Web Application Firewall (WAF).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The WordPress <code>xmlrpc.php<\/code> endpoint can be targeted by automated brute-force and abuse attempts. Continuous <code>POST<\/code> requests to this endpoint can generate unnecessary PHP-FPM and server load.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For websites that <strong>do not require XML-RPC<\/strong>, blocking the endpoint at the Nginx level is a simple and effective preventive measure:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">location = \/xmlrpc.php {<br>    deny all;<br>}<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After implementing the rule, always:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ nginx -t<br>$ systemctl reload nginx<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then verify the response and logs to confirm that requests to <code>xmlrpc.php<\/code> are being denied with <strong>HTTP 403 Forbidden<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">FAQs<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">1. What is <code>xmlrpc.php<\/code> in WordPress?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><code>xmlrpc.php<\/code> is a WordPress endpoint that allows remote applications and services to communicate with a WordPress installation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">2. Why do attackers target <code>xmlrpc.php<\/code>?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers can abuse XML-RPC for automated login attempts, brute-force attacks, and other types of unwanted requests.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">3. How can I identify an XML-RPC attack?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Check the Nginx access logs:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ grep \"xmlrpc.php\" \/var\/log\/nginx\/access.log<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A large number of repeated <code>POST \/xmlrpc.php<\/code> requests can indicate abuse.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">4. How do I block XML-RPC using Nginx?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following inside the appropriate <code>server {}<\/code> block:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">location = \/xmlrpc.php {<br>    deny all;<br>}<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">5. Where should I add the configuration?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Add it to the Nginx virtual-host configuration for the affected WordPress website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ \/etc\/nginx\/sites-enabled\/default<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">However, the actual location may differ depending on your server configuration.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">6. How do I verify the Nginx configuration?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ nginx -t<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Do not reload\/restart Nginx if the configuration test reports an error.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">7. What HTTP status should I receive after blocking XML-RPC?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Normally:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTP 403 Forbidden<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">8. Does blocking XML-RPC affect the WordPress website?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">The normal WordPress website generally continues to work, but any functionality that specifically depends on XML-RPC may stop working.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, check the application&#8217;s requirements before blocking it.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">9. Can I block only POST requests instead of blocking the entire XML-RPC endpoint?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Nginx can be configured with more granular rules, but completely blocking the endpoint is simpler when XML-RPC is not required.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">10. Can I use a WAF instead of blocking XML-RPC?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. A WAF can provide more granular protection, including rate limiting and filtering malicious requests, while potentially allowing legitimate XML-RPC traffic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Talk to our experts:<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For assistance with DevOps, cloud infrastructure, or server-related requirements, please reach out to our team through the link below.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/pheonixsolutions.com\/contact\">https:\/\/pheonixsolutions.com\/contact<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction xmlrpc.php is a WordPress file that enables remote communication between WordPress and external applications or services. While it provides [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1022],"tags":[271,307,167],"class_list":["post-1808","post","type-post","status-publish","format-standard","hentry","category-web-architecture","tag-nginx","tag-security","tag-wordpress-2","psol-cat-web-architecture"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-ta","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1808","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=1808"}],"version-history":[{"count":3,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1808\/revisions"}],"predecessor-version":[{"id":11214,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1808\/revisions\/11214"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=1808"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=1808"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=1808"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}