Walter Ebert

<p>This plugin does more than just using the <code>xmlrpc_enabled</code> hook, because that is only used “To disable XML-RPC methods that require authentication”.</p>
<p>Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC.</p>
<p>It works with any webserver, because it does not use the .htaccess file.</p>
<h4>Testing the plugin</h4>
<p>From the command line you can test if the plugin is working correctly using <a href="https://curl.haxx.se/" rel="nofollow ugc">cURL</a>. Replace the <code>example.com</code> link to match your website:</p>
<pre><code>curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params><param><value><string/></value></param></params></methodCall>' https://example.com/xmlrpc.php
</code></pre>
<p>This should only return the following methods:<br />
– <code>system.multicall</code><br />
– <code>system.listMethods</code><br />
– <code>system.getCapabilities</code></p>


Remove XML-RPC Methods

Remove all WordPress methods from the XML-RPC API to increase security.

Vikash Chand

<h4>What Is xmlrpc.php?</h4>
<p><a href="http://www.xmlrpc.com/" rel="nofollow ugc">XML-RPC</a> is a remote procedure call (RPC) protocol, a feature included in WordPress, which enables data to be transmitted. It uses HTTP as the transport mechanism, and XML to encode its calls.</p>
<p>Unless you use remote technologies and mobile applications to update your WordPress site, you might not be familiar with XML-RPC. For the uninitiated, you can use xmlrpc.php to establish a remote connection to WordPress, and make updates to your site without directly logging in to your WordPress system.</p>
<p>XML-RPC is indeed useful for enabling remote connections between various external applications and WordPress. On the other hand, disabling this feature can help improve your site’s security.</p>
<h4>Why You Should Disable xmlrpc.php?</h4>
<p>The problem is that xmlrpc.php poses a security risk. It creates an additional access point to your site, which could leave it vulnerable to external attacks. Every time you authenticate XML-RPC, you need to supply your username and password. As you can imagine, this isn’t exactly ideal for security purposes.</p>
<p>For example, in order to prevent brute force attacks, you can limit login attempts on your WordPress site. However, with XML-RPC enabled, that limit does not exist. There’s no capping on login attempts, which means it’s only a matter of time before a determined cybercriminal gains access.</p>
<p>By disabling the feature, you are closing a potential area of entry for hackers.</p>
<p>XML-RPC functionality is turned on by default since WordPress 3.5. This plugin simply disables only the XML-RPC API Pingback Methods used by hackers on a WordPress site, providing an easy and simple way to disable/enable XML-RPC API Pingback Methods without completely disabling the XML-RPC API, which is used by some plugins and applications (i.e. mobile apps or a few Jetpack modules).</p>
<h4>Features</h4>
<p>Removes the following methods from the XML-RPC API interface.</p>
<ul>
<li>pingback.ping</li>
<li>pingback.extensions.getPingbacks</li>
<li>X-Pingback from HTTP headers</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 3.8.1 or higher.</li>
</ul>


Simple XML-RPC Pingback Disabler

This plugin simply disables only the XML-RPC API Pingback Methods used by hackers on a WordPress site, providing an easy and simple way to disable/ena …

Remove XML-RPC Methods vs Simple XML-RPC Pingback Disabler