First of all, WordPress (as well as other publishing systems) use the xmlrpc.php library for handing a posted item. Unfortunately, many people with malicious intent are well aware of the default filenames and locations of these files and try to hack into them for their own purposes. Some web hosting services—including the one I use—are beginning to invoke a policy that this file must be renamed. Fortunately, it’s easy to configure the WordPress config files to point to the new file name, but it has the caveat of breaking any 3rd party service that only knows how to look for xmlrpc.php. Regrettably, the WordPress iPhone app will only look for that file.

My solution—and I really don’t understand why it works—is that I simply made a copy of the file and named it back to xmlrpc.php. I also had to add the SecFilterInheritance Off in the htaccess file to apply to xmlrpc as well as to the “real” differently named file.

At the moment, I cannot understand how this workaround is possible because 1) I don’t know how the WP engine knows about the file (at the moment, I can’t remember where the config file is to define it), and 2) I thought my web host blocked it.