DeveloperWil

Completely disables the XML-RPC API which was introduced in WordPress 3.5 and above which lets remote clients post, upload and edit content.
Notes: 
If you are using the WordPress smart phone app or the Jetpack plugin, please note that they need this service enabled.
If you activate this plugin your WordPress phone app will not be able to connect to your site and Jetpack will not be able to connect to wordpress.com where site visitor data (and other stuff) is stored.
Other plugins and services that use the XML-RPC API will also not function properly.
<h4>Plugin Page</h4>
<a href="https://zeropointdevelopment.com/wordpress-plugins/deactivate-xml-rpc-service-wordpress-plugin/" title="Deactivate XML-RPC Service WordPress Plugin" rel="nofollow ugc">Deactivate XML-RPC</a>

Deactivate XML-RPC Service

Disables the XMP-RPC API service introduced in WordPress 3.5 and above.

Walter Ebert

This plugin does more than just using the <code>xmlrpc_enabled</code> hook, because that is only used “To disable XML-RPC methods that require authentication”.
Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC.
It works with any webserver, because it does not use the .htaccess file.
<h4>Testing the plugin</h4>
From the command line you can test if the plugin is working correctly using <a href="https://curl.haxx.se/" rel="nofollow ugc">cURL</a>. Replace the <code>example.com</code> link to match your website:
<pre><code>curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params><param><value><string/></value></param></params></methodCall>' https://example.com/xmlrpc.php
</code></pre>
This should only return the following methods: 
– <code>system.multicall</code> 
– <code>system.listMethods</code> 
– <code>system.getCapabilities</code>

Remove XML-RPC Methods

Remove all WordPress methods from the XML-RPC API to increase security.

Deactivate XML-RPC Service vs Remove XML-RPC Methods