diff --git a/xmlrpc.cgi b/xmlrpc.cgi
index 9cb0fa107..64314cbcf 100755
--- a/xmlrpc.cgi
+++ b/xmlrpc.cgi
@@ -20,7 +20,7 @@ use WebminCore;
 use POSIX;
 use Socket;
 $force_lang = $default_lang;
-$trust_unknown_referers = 1;
+$trust_unknown_referers = 2;	# Only trust if referer was not set
 &init_config();
 $main::error_must_die = 1;