realflash

<p>A WordPress plugin that allows access to the whole WP API via XML-RPC.</p>
<h3>What does it do?</h3>
<p>The full WP API is comprehensive, but most of it is only available to plugin code, not remotely. The official WP XML-RPC API is much smaller. This plugin opens up access to that full internal API remotely so that you can do whatever you want over XML-RPC.</p>
<h3>Which methods does it allow me to call?</h3>
<p>Anything in the <a href="https://codex.wordpress.org/Function_Reference" rel="nofollow ugc">WordPress Function Reference</a> that your username has access to.</p>
<h3>How do I use it?</h3>
<p>First you should make sure that you have working code that can interact with the standard supported methods in the <a href="https://codex.wordpress.org/XML-RPC_WordPress_API" rel="nofollow ugc">XML-RPC WordPress API</a>. Once you do, you are ready to use this plugin. See also <a href="https://codex.wordpress.org/XML-RPC_Support" rel="nofollow ugc">About WordPress XML-RPC Support</a>.</p>
<p>Simply set the method name to wpext.callWpMethod, and then pass the WP API method name that you want to call as the first parameter, followed by any other parameters meeded by that method. Exactly how you do this depends upon the XML-RPC client library you are using in your code. So (for example), if you are currently using the XML-RPC API like this:</p>
<pre><code>$xmlrpc_client->call('wp.getComment', 5);
</code></pre>
<p>then instead do this:</p>
<pre><code>$xmlrpc_client->call('wpext.callWpMethod', 'wp_create_user', $new_username, $new_password, $new_email);
</code></pre>
<p>or</p>
<pre><code>$xmlrpc_client->call('wpext.callWpMethod', 'wp_delete_user', $id_to_delete);
</code></pre>
<p>These examples are pseudo-code: they do not relate to a specific XML-RPC client.</p>
<h3>Settings</h3>
<p>There is only one, and that is the list of functions that should be allowed over XML-RPC. See Settings > Extended API in your dashboard to set it. To allow one additional function, simply set it to the name of that function:</p>
<pre><code>wp_create_user
</code></pre>
<p>To specify multiple functions, separate with commas:</p>
<pre><code>wp_create_user,wp_delete_user[,method3]...
</code></pre>
<p>To protect you from yourself, this setting comes with a dummy value that does not correspond to a real method. This is to force you to think about what methods you really need to enable. If you set this value to the empty string (blank), all methods are allowed.</p>
<h3>Security</h3>
<p>There are good reasons why the XML-RPC API only has limited methods. Think carefully about whether this plugin is right for your situation, and only enable the methods you really need.</p>


Extended API over XMLRPC

A WordPress plugin that allows access to the whole WP API via XML-RPC.

codegee0958

<p><strong>GhostGate</strong> is a lightweight yet powerful WordPress security plugin that eliminates the login page as an attack surface. Instead of just defending, it <strong>erases the entrance</strong> entirely with dynamic login URLs and multi-layer access verification.</p>
<ul>
<li>🔒 Hide your login URL with a custom slug and time-based code</li>
<li>🔑 Built-in 2FA via email verification</li>
<li>🚫 Auto-block brute force attacks by IP</li>
<li>🧱 Disable/limit unused endpoints like XML-RPC and REST API</li>
<li>👤 Prevent user enumeration via REST, RSS, and author queries</li>
<li>🔍 Visualize security status and detect conflicts</li>
<li>📜 Activity logs with optional file rotation</li>
</ul>
<p>GhostGate doesn’t just defend — it disappears.<br />
Invisible to bots. Intuitive for users.</p>
<p>👉 <strong>Full features / screenshots / pricing / docs</strong>:<br />
https://arce-experience.com/product/</p>
<h3>Privacy</h3>
<p>GhostGate can store the following data locally on your site to provide rate-limiting and security auditing:<br />
– IP addresses (for temporary throttling / block lists)<br />
– Timestamps and event metadata (login attempts, REST/XML-RPC hits)<br />
– Optional log files under <code>wp-content/uploads/ghostgate/logs</code> (if enabled)</p>
<p>No data is sent to third-party services.<br />
Site owners are responsible for informing users/visitors where required by local laws. You can clear blocks/logs from the admin UI or by deleting the log files.</p>


GhostGate

Invisible, intelligent protection for WordPress. GhostGate hides your login page, blocks bots, and turns your site into a ghost fortress.

Extended API over XMLRPC vs GhostGate