Vikash Chand

<h4>What Is xmlrpc.php?</h4>
<p><a href="http://www.xmlrpc.com/" rel="nofollow ugc">XML-RPC</a> is a remote procedure call (RPC) protocol, a feature included in WordPress, which enables data to be transmitted. It uses HTTP as the transport mechanism, and XML to encode its calls.</p>
<p>Unless you use remote technologies and mobile applications to update your WordPress site, you might not be familiar with XML-RPC. For the uninitiated, you can use xmlrpc.php to establish a remote connection to WordPress, and make updates to your site without directly logging in to your WordPress system.</p>
<p>XML-RPC is indeed useful for enabling remote connections between various external applications and WordPress. On the other hand, disabling this feature can help improve your site’s security.</p>
<h4>Why You Should Disable xmlrpc.php?</h4>
<p>The problem is that xmlrpc.php poses a security risk. It creates an additional access point to your site, which could leave it vulnerable to external attacks. Every time you authenticate XML-RPC, you need to supply your username and password. As you can imagine, this isn’t exactly ideal for security purposes.</p>
<p>For example, in order to prevent brute force attacks, you can limit login attempts on your WordPress site. However, with XML-RPC enabled, that limit does not exist. There’s no capping on login attempts, which means it’s only a matter of time before a determined cybercriminal gains access.</p>
<p>By disabling the feature, you are closing a potential area of entry for hackers.</p>
<p>XML-RPC functionality is turned on by default since WordPress 3.5. This plugin completely disables the XML-RPC API which can be abused by hackers on a WordPress site, providing an easy and simple way to disable/enable the XML-RPC API.</p>
<h4>Requirements</h4>
<ul>
<li>WordPress 3.8.1 or higher.</li>
</ul>


Simple XML-RPC Disabler

This plugin completely disables the XML-RPC API which can be abused by hackers on a WordPress site, providing an easy and simple way to disable/enable …

Samuel Aguilera

<p>Stops abuse of your site’s XML-RPC by simply removing some methods used by attackers. While you can use the rest of XML-RPC methods.</p>
<p>This is more friendly than disabling totally XML-RPC, that it’s needed by some plugins and apps (I.e. Mobile apps or some Jetpack’s modules).</p>
<ul>
<li>The original one.</li>
<li>Simple and effective.</li>
<li>No marketing buzz.</li>
<li>Maintained and <strong>updated when needed</strong> since 2014.</li>
<li>100% compliant with <strong>WordPress coding standards</strong> which makes it fail safe.</li>
<li><strong>60,000+ active installations</strong> can’t be wrong.</li>
</ul>
<p>If you’re happy with the plugin <a href="https://wordpress.org/support/plugin/disable-xml-rpc-pingback/reviews/?filter=5" rel="ugc">please don’t forget to give it a good rating</a>, it will motivate me to keep sharing and improving this plugin (and others).</p>
<h4>Features</h4>
<p>Removes the following methods from XML-RPC interface.</p>
<ul>
<li>pingback.ping</li>
<li>pingback.extensions.getPingbacks</li>
<li>X-Pingback from HTTP headers. This will hopefully stops some bots from trying to hit your xmlrpc.php file.</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 3.8.1 or higher.</li>
</ul>


Disable XML-RPC Pingback

Gran trabajo Samuel, en combinación con algunas reglas de htaccess hace un trabajo fantástico.

Fantástico plugin, imprescindible

Stops abuse of your site's XML-RPC by simply removing some methods used by attackers. While you can use the rest of XML-RPC methods.

Simple XML-RPC Disabler vs Disable XML-RPC Pingback