DawsonyWeb

DawsonyWeb Security Shield protects your WordPress site from comment spam and unauthorised API access.
Comment Protection
<ul>
<li>Master switch to completely disable all comments (form, REST API, XML-RPC, feeds)</li>
<li>Invisible honeypot field to trap bots</li>
<li>Minimum comment length enforcement</li>
<li>Block all links or cap links per comment</li>
<li>Require login to comment</li>
<li>Keyword/phrase blocklist</li>
</ul>
API & REST Hardening
<ul>
<li>Disable XML-RPC entirely (removes X-Pingback header too)</li>
<li>Hide <code>/wp/v2/users</code> endpoint to prevent username harvesting</li>
<li>Require authentication for all REST API requests</li>
<li>Optionally disable the REST API completely</li>
<li>Block author enumeration via <code>/?author=N</code></li>
</ul>
Spam Rules
<ul>
<li>Per-IP comment rate limiting (configurable max and time window)</li>
<li>IP address blocklist — blocked IPs receive a 403 on any front-end request</li>
<li>Rolling activity log (last 200 events)</li>
</ul>

DawsonyWeb – Security Shield

Spam comment protection, comment disabling, XML-RPC hardening, REST API lockdown, user enumeration blocking, and IP blocklisting.

Jonny Harris

Simple plugin that disables XML-RPC, since it is enabled by default on WordPress 3.5 and above. It also removed references in the headers and in the body of the html.
If you wish to follow the development of this plugin, view the code on the official plugin <a href="http://www.jonathandavidharris.co.uk/scripts/disable-xml-rpc-fully/" title="website" rel="nofollow ugc">website</a> or follow me on twitter <a href="https://twitter.com/thespacedmonkey" rel="nofollow ugc">@thespacedmonkey</a>

DawsonyWeb – Security Shield vs Disable XML RPC Fully