Walter Ebert

<p>This plugin does more than just using the <code>xmlrpc_enabled</code> hook, because that is only used “To disable XML-RPC methods that require authentication”.</p>
<p>Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC.</p>
<p>It works with any webserver, because it does not use the .htaccess file.</p>
<h4>Testing the plugin</h4>
<p>From the command line you can test if the plugin is working correctly using <a href="https://curl.haxx.se/" rel="nofollow ugc">cURL</a>. Replace the <code>example.com</code> link to match your website:</p>
<pre><code>curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params><param><value><string/></value></param></params></methodCall>' https://example.com/xmlrpc.php
</code></pre>
<p>This should only return the following methods:<br />
– <code>system.multicall</code><br />
– <code>system.listMethods</code><br />
– <code>system.getCapabilities</code></p>


Remove XML-RPC Methods

Remove all WordPress methods from the XML-RPC API to increase security.

Samuel Aguilera

<p>Stops abuse of your site’s XML-RPC by simply removing some methods used by attackers. While you can use the rest of XML-RPC methods.</p>
<p>This is more friendly than disabling totally XML-RPC, that it’s needed by some plugins and apps (I.e. Mobile apps or some Jetpack’s modules).</p>
<ul>
<li>The original one.</li>
<li>Simple and effective.</li>
<li>No marketing buzz.</li>
<li>Maintained and <strong>updated when needed</strong> since 2014.</li>
<li>100% compliant with <strong>WordPress coding standards</strong> which makes it fail safe.</li>
<li><strong>60,000+ active installations</strong> can’t be wrong.</li>
</ul>
<p>If you’re happy with the plugin <a href="https://wordpress.org/support/plugin/disable-xml-rpc-pingback/reviews/?filter=5" rel="ugc">please don’t forget to give it a good rating</a>, it will motivate me to keep sharing and improving this plugin (and others).</p>
<h4>Features</h4>
<p>Removes the following methods from XML-RPC interface.</p>
<ul>
<li>pingback.ping</li>
<li>pingback.extensions.getPingbacks</li>
<li>X-Pingback from HTTP headers. This will hopefully stops some bots from trying to hit your xmlrpc.php file.</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 3.8.1 or higher.</li>
</ul>


Disable XML-RPC Pingback

Gran trabajo Samuel, en combinación con algunas reglas de htaccess hace un trabajo fantástico.

Fantástico plugin, imprescindible

Stops abuse of your site's XML-RPC by simply removing some methods used by attackers. While you can use the rest of XML-RPC methods.

Remove XML-RPC Methods vs Disable XML-RPC Pingback