Quickly toggle XML-RPC on/off from your dashboard. Perfect for temporarily enabling access for mobile apps, then securing your site again.

sourcecode347

Anti Browser DDoS Protection

Protects WordPress from DDoS with rate limiting, bot detection, blocking, Cloudflare support, logs, charts, and bot list export/import.

peterswe

Your Web Shield

Your Web Shield blocks high-risk IPs and limits request rates, providing enhanced security for your site.

susheelhbti

TrapFlux Request Firewall

Lightweight, behavior-based bot firewall. Blocks scanners before WordPress loads, with text attack reports for your hosting company.

aph5

<ul>
<li>XML-RPC Control Dashboard provides WordPress administrators with a way of quickly toggling on/off the XML-RPC functionality.</li>
<li>On initial installation and activation, XML-RPC will be disabled,</li>
<li>It displays the current enabled/disabled status in the dashboard, helping users avoid leaving access on unnecessarily.</li>
<li>It features XML-RPC rate limiting functionality, providing some protection to users while XML-RPC is on.</li>
<li>Rate limiting is on by default, but can be turned off. Note that it’s not perfect security however, and we recommend XML-RPC is disabled after use.</li>
</ul>
<h4>Why Control XML-RPC?</h4>
<p>XML-RPC is a WordPress feature that allows remote access to your site. While useful for legitimate applications like mobile apps and remote publishing, it’s frequently exploited for:</p>
<ul>
<li>Brute force password attacks</li>
<li>DDoS amplification attacks via pingbacks</li>
<li>Spam distribution</li>
<li>Resource exhaustion</li>
</ul>
<h4>Rate Limiting Protection</h4>
<p>When enabled, the plugin automatically limits:</p>
<ul>
<li><strong>Failed Authentication</strong> – Maximum 5 failed login attempts per hour per IP</li>
<li><strong>High-Risk Methods</strong> – Limits on pingback.ping, system.multicall, and other abuse-prone methods</li>
<li><strong>IP Validation</strong> – Prevents IP spoofing by validating addresses and processing proxy headers correctly</li>
</ul>
<h4>Privacy</h4>
<p>This plugin does not collect, store, or transmit any user data outside your WordPress installation. All rate limiting data is stored temporarily using WordPress transients and is automatically cleaned up.</p>
<h3>Additional Information</h3>
<h4>Support</h4>
<p>For support, feature requests, or bug reports, please visit the plugin’s support forum.</p>
<h4>Contributing</h4>
<p>Feedback is welcomed.</p>
<h4>Security</h4>
<p>If you discover a security vulnerability, please report it responsibly via the WordPress security team or directly to the plugin author.</p>


Alternatives to Disable XML-RPC – Dashboard Control

Top alternatives