aph5

<ul>
<li>XML-RPC Control Dashboard provides WordPress administrators with a way of quickly toggling on/off the XML-RPC functionality.</li>
<li>On initial installation and activation, XML-RPC will be disabled,</li>
<li>It displays the current enabled/disabled status in the dashboard, helping users avoid leaving access on unnecessarily.</li>
<li>It features XML-RPC rate limiting functionality, providing some protection to users while XML-RPC is on.</li>
<li>Rate limiting is on by default, but can be turned off. Note that it’s not perfect security however, and we recommend XML-RPC is disabled after use.</li>
</ul>
<h4>Why Control XML-RPC?</h4>
<p>XML-RPC is a WordPress feature that allows remote access to your site. While useful for legitimate applications like mobile apps and remote publishing, it’s frequently exploited for:</p>
<ul>
<li>Brute force password attacks</li>
<li>DDoS amplification attacks via pingbacks</li>
<li>Spam distribution</li>
<li>Resource exhaustion</li>
</ul>
<h4>Rate Limiting Protection</h4>
<p>When enabled, the plugin automatically limits:</p>
<ul>
<li><strong>Failed Authentication</strong> – Maximum 5 failed login attempts per hour per IP</li>
<li><strong>High-Risk Methods</strong> – Limits on pingback.ping, system.multicall, and other abuse-prone methods</li>
<li><strong>IP Validation</strong> – Prevents IP spoofing by validating addresses and processing proxy headers correctly</li>
</ul>
<h4>Privacy</h4>
<p>This plugin does not collect, store, or transmit any user data outside your WordPress installation. All rate limiting data is stored temporarily using WordPress transients and is automatically cleaned up.</p>
<h3>Additional Information</h3>
<h4>Support</h4>
<p>For support, feature requests, or bug reports, please visit the plugin’s support forum.</p>
<h4>Contributing</h4>
<p>Feedback is welcomed.</p>
<h4>Security</h4>
<p>If you discover a security vulnerability, please report it responsibly via the WordPress security team or directly to the plugin author.</p>


Disable XML-RPC – Dashboard Control

Quickly toggle XML-RPC on/off from your dashboard. Perfect for temporarily enabling access for mobile apps, then securing your site again.

peterswe

<p>Your Web Shield blocks high-risk IPs and limits request rates, providing enhanced security for your site.</p>
<h3>External Services</h3>
<p>This plugin relies on the external service “Your Web Shield API” to check IP addresses for risk scoring.<br />
API Documentation: https://www.postman.com/ywspeter/your-web-shield/request/uvtu6ua/ip-details<br />
Terms of Service: https://www.yourwebshield.co.uk/terms<br />
Privacy Policy: https://www.yourwebshield.co.uk/privacy</p>


Your Web Shield

Your Web Shield blocks high-risk IPs and limits request rates, providing enhanced security for your site.

Disable XML-RPC – Dashboard Control vs Your Web Shield