DawsonyWeb

DawsonyWeb Security Shield protects your WordPress site from comment spam and unauthorised API access.
Comment Protection
<ul>
<li>Master switch to completely disable all comments (form, REST API, XML-RPC, feeds)</li>
<li>Invisible honeypot field to trap bots</li>
<li>Minimum comment length enforcement</li>
<li>Block all links or cap links per comment</li>
<li>Require login to comment</li>
<li>Keyword/phrase blocklist</li>
</ul>
API & REST Hardening
<ul>
<li>Disable XML-RPC entirely (removes X-Pingback header too)</li>
<li>Hide <code>/wp/v2/users</code> endpoint to prevent username harvesting</li>
<li>Require authentication for all REST API requests</li>
<li>Optionally disable the REST API completely</li>
<li>Block author enumeration via <code>/?author=N</code></li>
</ul>
Spam Rules
<ul>
<li>Per-IP comment rate limiting (configurable max and time window)</li>
<li>IP address blocklist — blocked IPs receive a 403 on any front-end request</li>
<li>Rolling activity log (last 200 events)</li>
</ul>

DawsonyWeb – Security Shield

Spam comment protection, comment disabling, XML-RPC hardening, REST API lockdown, user enumeration blocking, and IP blocklisting.

Solve the Net

Phil Erb

Pretty simply, this plugin uses the built-in WordPress filter “xmlrpc_enabled” to disable the XML-RPC API on a WordPress site running 3.5 or above.
Beginning in 3.5, XML-RPC is enabled by default. Additionally, the option to disable/enable XML-RPC was removed. For various reasons, site owners may wish to disable this functionality. This plugin provides an easy way to do so.

Disable XML-RPC


Dead simple as it should be. Nice, thank you for that.


Reduced to perfection

Disables the XML-RPC API in WordPress 3.5+, which is enabled by default.

DawsonyWeb – Security Shield vs Disable XML-RPC