DawsonyWeb

DawsonyWeb Security Shield protects your WordPress site from comment spam and unauthorised API access.
Comment Protection
<ul>
<li>Master switch to completely disable all comments (form, REST API, XML-RPC, feeds)</li>
<li>Invisible honeypot field to trap bots</li>
<li>Minimum comment length enforcement</li>
<li>Block all links or cap links per comment</li>
<li>Require login to comment</li>
<li>Keyword/phrase blocklist</li>
</ul>
API & REST Hardening
<ul>
<li>Disable XML-RPC entirely (removes X-Pingback header too)</li>
<li>Hide <code>/wp/v2/users</code> endpoint to prevent username harvesting</li>
<li>Require authentication for all REST API requests</li>
<li>Optionally disable the REST API completely</li>
<li>Block author enumeration via <code>/?author=N</code></li>
</ul>
Spam Rules
<ul>
<li>Per-IP comment rate limiting (configurable max and time window)</li>
<li>IP address blocklist — blocked IPs receive a 403 on any front-end request</li>
<li>Rolling activity log (last 200 events)</li>
</ul>

DawsonyWeb – Security Shield

Spam comment protection, comment disabling, XML-RPC hardening, REST API lockdown, user enumeration blocking, and IP blocklisting.

Walter Ebert

Removes all WordPress methods from the XML-RPC API to increase security. It does more than just using the <code>xmlrpc_enabled</code> hook, because that is only used “To disable XML-RPC methods that require authentication”.
Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC.
It works with any webserver, because it does not use the .htaccess file.
<h4>Testing the plugin</h4>
From the command line you can test if the plugin is working correctly using <a href="https://curl.haxx.se/" rel="nofollow ugc">curl</a>. Replace the <code>example.com</code> link to match your website:
<pre><code>curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params><param><value><string/></value></param></params></methodCall>' https://example.com/xmlrpc.php
</code></pre>
This should only return the following methods: 
– <code>system.multicall</code> 
– <code>system.listMethods</code> 
– <code>system.getCapabilities</code>

Remove XML-RPC Methods

Remove all WordPress methods from the XML-RPC API to increase security.

DawsonyWeb – Security Shield vs Remove XML-RPC Methods