diff --git a/htaccess.tmpl b/htaccess.tmpl
index 24739f8..8079582 100644
--- a/htaccess.tmpl
+++ b/htaccess.tmpl
@@ -55,3 +55,8 @@ RewriteRule . index.php [L]
 
 # END WordPress Multisite
 {{- end }}
+
+# Block XML-RPC
+<Files xmlrpc.php>
+    Require all denied
+</Files>