News
Webmention vs Pingback for Public Blogs
May 29, 2026
Webmention vs Pingback for public blogs is a notification-protocol decision: Webmention (W3C) is a simple HTTP mention flow, while Pingback is an older XML-RPC handshake still enabled on many WordPress origins. Prefer Webmention if you want IndieWeb notifications; disable Pingback if you do not have a reason to keep XML-RPC open. RoastMyOpsec does not score Webmention or Pingback discovery as a standalone F, and neither protocol is consent to scan someone else’s site.
The practical difference
Pingback sends an XML-RPC method when another site thinks it linked to you. It historically needed xmlrpc.php reachable. Webmention is a POST of source and target URLs after discovering a rel=webmention endpoint, specified by the W3C. Both can be abused as unsolicited traffic; both can be useful for a blog that wants a public conversation.
The OPSEC difference is blast radius. XML-RPC on WordPress is a wider surface than mention notifications. If you do not need remote publishing or pingbacks, turning that endpoint off is ordinary hardening — not a how-to for attacking it. Webmention endpoints should verify that the source actually links to the target before displaying anything.
Unsolicited probing of other people’s blogs “to test pingback” is not research. Scan URLs you own. Mentions are not a vulnerability disclosure channel; that is security.txt.
How to choose based on what you shipped
If you run a static or IndieWeb-aware blog and want notifications, advertise Webmention and verify sources. If you run WordPress and do not use Pingback, disable it and do not leave xmlrpc.php as a public toy. If you want neither, omit the link headers and live a quiet life.
| Option | When it wins | Watch-out | Takeaway |
|---|---|---|---|
| Webmention | You want W3C mentions with URL verification | Displaying unvalidated source HTML | Prefer this if you want mentions |
| Pingback | A legacy network still depends on it | XML-RPC surface you did not mean to keep | Disable if unused |
| Neither | A brochure or docs site with no conversation | Plugins re-enabling xmlrpc.php | Healthy default |
| security.txt | You want researchers to reach a mailbox | Putting Contact only in a mention endpoint | Different job than mentions |
When Pingback still wins
Pingback still wins only when a specific community still sends it and you have mitigated XML-RPC to what you actually need. Webmention still wins for new mention support. Missing both is normal. Leaving unused XML-RPC enabled is the blog-platform miss, not a roast F for absent rel=webmention.
Common mistakes
The first mistake is leaving Pingback XML-RPC enabled because a default theme advertised it.
The second mistake is rendering Webmention source pages without checking the link exists.
The third mistake is treating a missing Webmention endpoint as a security finding.
What a URL roast can prove
RoastMyOpsec is a consent-based roast of a URL you own: headers, TLS, cookies, path probes (.git/HEAD, .env, package.json signatures), and js-secrets. It does not score Webmention, Pingback, rel=me, JSON-LD, or RSS as standalone Fs. It is not a license to ping other people’s xmlrpc.php. Confirm mention endpoints yourself if you ship them.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Should a new blog enable Pingback?
- Usually no. Prefer Webmention if you want mentions, or neither. Treat unused XML-RPC as extra surface.
- Is Webmention a security.txt replacement?
- No. Mentions are public conversation. Researcher intake belongs in RFC 9116.
- Does RoastMyOpsec test pingbacks?
- No. It does not send Pingback or Webmention payloads and does not score those endpoints as Fs.