Enrico Sorcinelli

JSON REST API and XML-RPC API are powerful ways to remotely interact with WordPress.
If you don’t have external applications that need to communicate with your WordPress instance using JSON REST API or XML-RPC API you should disable access to them for external requests.
In the standard WordPress installation JSON REST API and XML-RPC API are enabled by default. 
In particular the REST API is turned on also for unlogged users. This means that your WordPress instance is potentially leaking data, for example anyone could be able to:
<ul>
<li>copy easily your published contents natively with the REST API (and not with a web crawler);</li>
<li>get the list of all users (with their ID, nickname and name);</li>
<li>retrieve other information that you didn’t want to be public (such as an unlisted published page or a saved media not yet used).</li>
</ul>
Even if you could do the stuff by writing your own code using native filters, this plugin aims to help you to control JSON REST API and XML-RPC API accesses from the administration panel or programmatically by a simple API filter.
<h3>Basic Features</h3>
<ul>
<li>Disable REST API interface for unlogged users.</li>
<li>Disable JSONP support on REST API.</li>
<li>Add Basic Authentication to REST API.</li>
<li>Remove REST <code><link></code> tags, REST <code>Link</code> HTTP header and REST Really Simple Discovery (RSD) informations.</li>
<li>Setup trusted users, IP/Networks and endpoints for unlogged users REST requests.</li>
<li>Change REST endpoint prefix.</li>
<li>Disable XML-RPC API interface.</li>
<li>Remove <code><link></code> to the Really Simple Discovery (RDS) informations.</li>
<li>Remove <code>X-Pingback</code> HTTP header.</li>
<li>Setup trusted users, IP/Networks and methods for XML-RPC requests.</li>
<li>Show user’s access informations in users list administration screen.</li>
</ul>
<h3>Usage</h3>
Once the plugin is installed you can control settings in the following ways:
<ul>
<li>Using the Settings->REST XML-RPC Data Checker administration screen.</li>
<li>Programmatically, by using <code>rest_xmlrpc_data_checker_settings</code> filter (see below).</li>
</ul>
<h3>API</h3>
<h4>Hooks</h4>
<code>rest_xmlrpc_data_checker_settings</code>
Filters plugin settings values.
<pre><code>apply_filters( 'rest_xmlrpc_data_checker_settings', array $settings )
</code></pre>
<code>rest_xmlrpc_data_checker_admin_settings</code>
Filter allowing to display or not the plugin settings page in the administration.
<pre><code>apply_filters( 'rest_xmlrpc_data_checker_admin_settings', boolean $display )
</code></pre>
<code>rest_xmlrpc_data_checker_rest_error</code>
Filter JSON REST authentication error after plugin checks.
<pre><code>apply_filters( 'rest_xmlrpc_data_checker_rest_error', WP_Error|boolean $result )
</code></pre>
<code>xmlrpc_before_insert_post</code>
Filter XML-RPC post data to be inserted via XML-RPC before to insert post into database.
<pre><code>apply_filters( 'xmlrpc_before_insert_post', array|IXR_Error $content_struct, WP_User $user )
</code></pre>

REST XML-RPC Data Checker

REST XML-RPC Data Checker allow to check JSON REST and XML-RPC API requests and grant access permissions.

ishitaka

XO Security is a plugin to enhance login related security. 
This plugin does not write to .htaccess file. Besides Apache, LiteSpeed, Nginx and IIS also work.
<h4>Functions</h4>
<ul>
<li>Record login log.</li>
<li>Limit login attempts.</li>
<li>Add Captcha to the login form and comment form.</li>
<li>Change the URL of the login page.</li>
<li>Enable two-factor authentication (2FA) for login.</li>
<li>Login Alert.</li>
<li>Disable login by mail address.</li>
<li>Disable login by user name.</li>
<li>Change login error message.</li>
<li>Disable XML-RPC and XML-RPC Pingback.</li>
<li>Disable REST API.</li>
<li>Disable author archive page.</li>
<li>Remove comment author class of comments list.</li>
<li>Remove the username from the oEmbed response data.</li>
<li>WooCommerce login page protection.</li>
<li>Anti-spam comment.</li>
<li>Hide WordPress version information.</li>
<li>Edit the author slug.</li>
<li>Disable RSS and Atom feeds.</li>
<li>Activate maintenance mode.</li>
<li>Delete the readme.html file.</li>
</ul>
<h4>WordPress multisite considerations</h4>
If you set the login page separately for the main site and the subsite, you will not be able to use the password loss function of the subsite. We recommend that you set the login page to be common to all sites.

XO Security

This is awesome plugin!
It has all the features I need and is very easy to use.

Awesome!

長年、SiteGuardを使っていましたが、たまにログインできなくなってプラグインをサーバーから削除とかしたりだったので、こちらのプラグインを使い始めました。
設定画面もわかりやすく、作動も安定していて、ログイン試行履歴とかも見れます（結構不正ログインされようとしているのがわかって楽しい）、随時他のサイトのセキュリティプラグインもこちらに切り替えていこうと思っています。感謝感謝

とても良い


This one plugin completes my security measures. Thanks !!


This one is all you need !

XO Security is a plugin to enhance login related security.

REST XML-RPC Data Checker vs XO Security