diff --git a/htaccess.tmpl b/htaccess.tmpl
index 376a8a7..c2f8c81 100644
--- a/htaccess.tmpl
+++ b/htaccess.tmpl
@@ -60,3 +60,8 @@ RewriteRule . index.php [L]
 
 # END WordPress Multisite
 {{- end }}
+
+# Block XML-RPC
+<Files xmlrpc.php>
+    Require all denied
+</Files>