Walter Ebert

Removes all WordPress methods from the XML-RPC API to increase security. It does more than just using the <code>xmlrpc_enabled</code> hook, because that is only used “To disable XML-RPC methods that require authentication”.
Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC.
It works with any webserver, because it does not use the .htaccess file.
<h4>Testing the plugin</h4>
From the command line you can test if the plugin is working correctly using <a href="https://curl.haxx.se/" rel="nofollow ugc">curl</a>. Replace the <code>example.com</code> link to match your website:
<pre><code>curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params><param><value><string/></value></param></params></methodCall>' https://example.com/xmlrpc.php
</code></pre>
This should only return the following methods: 
– <code>system.multicall</code> 
– <code>system.listMethods</code> 
– <code>system.getCapabilities</code>

Remove XML-RPC Methods

Remove all WordPress methods from the XML-RPC API to increase security.

Max Cutler

Uses PHP’s output buffering to buffer XML-RPC responses and strip superfluous whitespace.
Plugins, themes, and any other files executed during the WordPress load process can unintentionally emit whitespace, 
such as by including a newline character after an explicit closing “?>” PHP tag instead of letting PHP auto-close the 
file.

XML-RPC De-whitespacer

Removes leading and trailing whitespace from XML-RPC responses that can break some XML-RPC clients.

Remove XML-RPC Methods vs XML-RPC De-whitespacer