Plugins DatabasePlugins Database logo
Back to plugins
Homepage WordPress

Actions

DownloadAuthor pageSee on WordPress

Plugin info

Total downloads: 553,429
Active installs: 100,000
Total reviews: 29
Average rating: 4.3
Support threads opened: 0
Support threads resolved: 0 (0%)
Available in: 1 language(s)
Contributors: 2
Last updated: 12/3/2025 (29 days ago)
Added to WordPress: 9/28/2012 (13 years old)
Minimum WordPress version: 3.5
Tested up to WordPress version: 6.9
Minimum PHP version: f

Maintenance & Compatibility

Maintenance score

Actively maintained • Last updated 29 days ago • 29 reviews

74/100

Is Disable XML-RPC abandoned?

Likely maintained (last update 29 days ago).

Compatibility

Requires WordPress: 3.5
Tested up to: 6.9
Requires PHP: f

Ratings

24
0
0
0
5See all reviews

Developers

Phil Erb (Owner)1Solve the Net1

Languages

Similar & Alternatives

Explore plugins with similar tags, and compare key metrics like downloads, ratings, updates, support, and WP/PHP compatibility.

Disable XML-RPC-API
Rating 4.1/5 (42 reviews) • Active installs 100,000
Compare
XO Security
Rating 5.0/5 (9 reviews) • Active installs 30,000
Compare
WP Hardening (discontinued)
Rating 4.1/5 (19 reviews) • Active installs 10,000
Compare
Remove & Disable XML-RPC Pingback
Rating 3.0/5 (6 reviews) • Active installs 9,000
Compare
Manage XML-RPC
Rating 3.0/5 (4 reviews) • Active installs 6,000
Compare
Rename XMLRPC
Rating 4.3/5 (12 reviews) • Active installs 1,000
Compare
See more alternatives to Disable XML-RPC

Description

Pretty simply, this plugin uses the built-in WordPress filter “xmlrpc_enabled” to disable the XML-RPC API on a WordPress site running 3.5 or above.

Beginning in 3.5, XML-RPC is enabled by default. Additionally, the option to disable/enable XML-RPC was removed. For various reasons, site owners may wish to disable this functionality. This plugin provides an easy way to do so.

Installation

  1. Upload the disable-xml-rpc directory to the /wp-content/plugins/ directory in your WordPress installation
  2. Activate the plugin through the ‘Plugins’ menu in WordPress
  3. The WordPress XML-RPC methods are now disabled!

To re-enable XML-RPC, just deactivate the plugin through the ‘Plugins’ menu.

View the FAQ about “How do I know if the plugin is working?” to verify that this is working as intended.

Frequently Asked Questions

Is there an admin interface for this plugin?

No. This plugin is as simple as XML-RPC is off (plugin activated) or XML-RPC is on (plugin is deactivated).

How do I know if the plugin is working?

There are a few easy methods for checking if XML-RPC is off:

  1. Try using an XML-RPC WordPress client, like the official WordPress mobile apps. The WordPress mobile app should tell you that “XML-RPC services are disabled on this site” if the plugin is activated.
  2. Use the curl command to send an XML-RPC request to your site. If the response contains “XML-RPC services are disabled on this site” then the plugin is working properly and WordPress will not send data back to XML-RPC requests.
  3. Try the XML-RPC Validation Service for WordPress – the tool is available at https://xmlrpc.blog/. Keep in mind that you want the validator to fail and tell you that XML-RPC services are disabled.

See the screenshots for examples of what these tools will return when the plugin is enabled.

Something doesn’t seem to be working correctly

If the plugin is activated, but XML-RPC appears to still be working … OR … the plugin is deactivated, but XML-RPC is not working, then it’s possible that another plugin or theme function is affecting the xmlrpc_enabled filter. Additionally, server configurations could be blocking XML-RPC (i.e. blocking access to xmlrpc.php in the .htaccess file).

Review feed

art-at-tec
4/9/2024

Reduced to perfection

Dead simple as it should be. Nice, thank you for that.

Screenshots

  1. An example of the error that the WordPress mobile app will return when this plugin is enabled. This is expected and indicates that the plugin is working as intended.

    An example of the error that the WordPress mobile app will return when this plugin is enabled. This is expected and indicates that the plugin is working as intended.

  2. An example of a curl command attempting to request data via XML-RPC calls to the site when the plugin is enabled. The error "XML-RPC services are disabled on this site" is expected and indicates that the plugin is working as intended.

    An example of a curl command attempting to request data via XML-RPC calls to the site when the plugin is enabled. The error "XML-RPC services are disabled on this site" is expected and indicates that the plugin is working as intended.

  3. An example of the XML-RPC validator run against the site when the plugin is enabled. The error "Method not allowed" is expected and indicates that the plugin is working as intended.

    An example of the XML-RPC validator run against the site when the plugin is enabled. The error "Method not allowed" is expected and indicates that the plugin is working as intended.

Changelog

1.0.1

  • Blank lines removed from the plugin file.

1.0

  • Initial release
Back to plugins