Templ can block access to WordPress's xmlrpc.php file, a common target for brute-force and denial-of-service attacks. You enable this per site under Website → Advanced → Site Options. Previously, when turned on, the block only matched /xmlrpc.php at the site root.
The block now applies to any file named xmlrpc.php, regardless of its path. This closes a gap for sites with a non-standard directory structure, such as Bedrock, where WordPress core lives in a subdirectory and the file is served at /wp/xmlrpc.php.
If you already have XML-RPC blocking enabled, the wider coverage applies automatically - no action needed.
On sites where blocking was enabled but the bug left
xmlrpc.php reachable at a non-root path, that file is now blocked as intended. If something relied on it - such as the WordPress mobile app or another service that talks to your site over XML-RPC - it will stop working. To restore that functionality, disable XML-RPC blocking for the site in the Templ Panel.See What's blocked on Templ for details.