diff --git a/data/interfaces/default/js/script.js b/data/interfaces/default/js/script.js
index f2dc2883..90050c46 100644
--- a/data/interfaces/default/js/script.js
+++ b/data/interfaces/default/js/script.js
@@ -557,7 +557,9 @@ $.fn.slideToggleBool = function(bool, options) {
 function openPlexXML(endpoint, plextv, params) {
     var data = $.extend({endpoint: endpoint, plextv: plextv}, params);
     $.getJSON('return_plex_xml_url', data, function(xml_url) {
-       window.open(xml_url, '_blank');
+        if (xml_url) {
+            window.open(xml_url, '_blank');
+        }
     });
 }
 
diff --git a/plexpy/config.py b/plexpy/config.py
index b3d904da..126310f9 100644
--- a/plexpy/config.py
+++ b/plexpy/config.py
@@ -75,6 +75,7 @@ _CONFIG_DEFINITIONS = {
     'PMS_UPDATE_DISTRO_BUILD': (str, 'PMS', ''),
     'PMS_UPDATE_CHECK_INTERVAL': (int, 'Advanced', 24),
     'PMS_WEB_URL': (str, 'PMS', 'https://app.plex.tv/desktop'),
+    'PMS_XML_SHORTCUTS': (int, 'Advanced', 0),
     'TIME_FORMAT': (str, 'General', 'HH:mm'),
     'ANON_REDIRECT': (str, 'General', ''),
     'ANON_REDIRECT_DYNAMIC': (int, 'General', 1),
diff --git a/plexpy/webserve.py b/plexpy/webserve.py
index 441e87d2..50fecaf4 100644
--- a/plexpy/webserve.py
+++ b/plexpy/webserve.py
@@ -382,6 +382,9 @@ class WebInterface(object):
     @cherrypy.tools.json_out()
     @requireAuth(member_of("admin"))
     def return_plex_xml_url(self, endpoint='', plextv=False, **kwargs):
+        if not (plexpy.CONFIG.HTTP_PASSWORD and plexpy.CONFIG.PMS_XML_SHORTCUTS):
+            return
+
         kwargs['X-Plex-Token'] = plexpy.CONFIG.PMS_TOKEN
 
         if helpers.bool_true(plextv):