diff --git a/htaccess.tmpl b/htaccess.tmpl
index a71a625..11b2574 100644
--- a/htaccess.tmpl
+++ b/htaccess.tmpl
@@ -60,3 +60,8 @@ RewriteRule . index.php [L]
 
 # END WordPress Multisite
 {{- end }}
+
+# Block XML-RPC
+<Files xmlrpc.php>
+    Require all denied
+</Files>