DeveloperWil

Completely disables the XML-RPC API which was introduced in WordPress 3.5 and above which lets remote clients post, upload and edit content.
Notes: 
If you are using the WordPress smart phone app or the Jetpack plugin, please note that they need this service enabled.
If you activate this plugin your WordPress phone app will not be able to connect to your site and Jetpack will not be able to connect to wordpress.com where site visitor data (and other stuff) is stored.
Other plugins and services that use the XML-RPC API will also not function properly.
<h4>Plugin Page</h4>
<a href="https://zeropointdevelopment.com/wordpress-plugins/deactivate-xml-rpc-service-wordpress-plugin/" title="Deactivate XML-RPC Service WordPress Plugin" rel="nofollow ugc">Deactivate XML-RPC</a>

Deactivate XML-RPC Service

Disables the XMP-RPC API service introduced in WordPress 3.5 and above.

Pascal CESCATO

Stop XML-RPC Attacks protects your WordPress site from XML-RPC brute force attacks, DDoS attempts, and reconnaissance probes while maintaining compatibility with essential services like Jetpack and WooCommerce.
Features:
<ul>
<li>Three security modes: Full Disable, Guest Disable, or Selective Blocking</li>
<li>Blocks dangerous methods: system.multicall, pingback.ping, and more</li>
<li>Compatible with Jetpack and WooCommerce</li>
<li>Optional user enumeration blocking</li>
<li>Attack logging for monitoring</li>
<li>Zero configuration required – works out of the box</li>
<li>Clean, intuitive admin interface</li>
</ul>

Stop XML-RPC Attacks

Blocks dangerous XML-RPC methods while preserving Jetpack, WooCommerce, and mobile apps compatibility.

Deactivate XML-RPC Service vs Stop XML-RPC Attacks