Disable WordPress XML-RPC

Disable WordPress XML-RPC

XML-RPC can be exploited for brute force attacks and DDoS. This snippet completely disables XML-RPC while maintaining essential WordPress functionality.

// Method 1: Completely disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');

// Method 2: Block XML-RPC requests
function disable_xmlrpc_completely() {
    // Return 403 Forbidden for XML-RPC requests
    if (defined('XMLRPC_REQUEST') && XMLRPC_REQUEST) {
        header('HTTP/1.1 403 Forbidden');
        die('XML-RPC is disabled on this site.');
    }
}
add_action('init', 'disable_xmlrpc_completely', 1);

// Method 3: Remove XML-RPC from HTTP headers
function remove_xmlrpc_pingback_header($headers) {
    if (isset($headers['X-Pingback'])) {
        unset($headers['X-Pingback']);
    }
    return $headers;
}
add_filter('wp_headers', 'remove_xmlrpc_pingback_header');

// Remove RSD link from header (Really Simple Discovery)
remove_action('wp_head', 'rsd_link');

// Remove Windows Live Writer manifest link
remove_action('wp_head', 'wlwmanifest_link');

// Disable XML-RPC pingback
function disable_xmlrpc_pingback($methods) {
    unset($methods['pingback.ping']);
    unset($methods['pingback.extensions.getPingbacks']);
    return $methods;
}
add_filter('xmlrpc_methods', 'disable_xmlrpc_pingback');

.htaccess Method (Apache)

Add to your .htaccess file:

# Block access to xmlrpc.php
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>

Nginx Configuration

Add to your Nginx configuration:

# Block xmlrpc.php
location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
    return 444;
}

Selective Disable (Keep Jetpack Working)

// Disable XML-RPC but allow Jetpack
function disable_xmlrpc_except_jetpack($methods) {
    // Get all XML-RPC methods
    $jetpack_methods = array(
        'jetpack.testAPIUserCode',
        'jetpack.testConnection',
        'jetpack.remoteAuthorize',
        'jetpack.remoteProvision',
        'jetpack.remoteConnect',
        'jetpack.remoteDisconnect',
        'jetpack.remoteRegister',
        'jetpack.getUser',
    );

    // Remove all methods except Jetpack
    foreach ($methods as $method => $callback) {
        if (!in_array($method, $jetpack_methods)) {
            unset($methods[$method]);
        }
    }

    return $methods;
}
add_filter('xmlrpc_methods', 'disable_xmlrpc_except_jetpack');

Log XML-RPC Attempts

// Log XML-RPC access attempts
function log_xmlrpc_attempts() {
    if (defined('XMLRPC_REQUEST') && XMLRPC_REQUEST) {
        $ip = $_SERVER['REMOTE_ADDR'];
        $user_agent = $_SERVER['HTTP_USER_AGENT'];
        $timestamp = current_time('mysql');

        error_log(sprintf(
            'XML-RPC attempt - IP: %s, User-Agent: %s, Time: %s',
            $ip,
            $user_agent,
            $timestamp
        ));

        // Optional: Send email alert
        $admin_email = get_option('admin_email');
        $subject = 'XML-RPC Access Attempt Detected';
        $message = sprintf(
            "An XML-RPC request was blocked:\n\nIP Address: %s\nUser-Agent: %s\nTime: %s\nURL: %s",
            $ip,
            $user_agent,
            $timestamp,
            $_SERVER['REQUEST_URI']
        );

        wp_mail($admin_email, $subject, $message);
    }
}
add_action('init', 'log_xmlrpc_attempts', 1);

Complete Security Package

// Comprehensive XML-RPC security
class XMLRPC_Security {

    public function __construct() {
        // Disable XML-RPC
        add_filter('xmlrpc_enabled', '__return_false');

        // Remove headers
        add_filter('wp_headers', array($this, 'remove_headers'));

        // Remove links from head
        remove_action('wp_head', 'rsd_link');
        remove_action('wp_head', 'wlwmanifest_link');

        // Block requests
        add_action('init', array($this, 'block_requests'), 1);

        // Add admin notice
        add_action('admin_notices', array($this, 'admin_notice'));
    }

    public function remove_headers($headers) {
        unset($headers['X-Pingback']);
        return $headers;
    }

    public function block_requests() {
        if (defined('XMLRPC_REQUEST') && XMLRPC_REQUEST) {
            header('HTTP/1.1 403 Forbidden');
            header('Content-Type: text/plain');
            die('XML-RPC is disabled for security reasons.');
        }
    }

    public function admin_notice() {
        echo '<div class="notice notice-success is-dismissible">';
        echo '<p><strong>Security:</strong> XML-RPC is disabled on this site.</p>';
        echo '</div>';
    }
}

// Initialize
new XMLRPC_Security();

Check if XML-RPC is Disabled

Test by running this in your browser or with curl:

curl -X POST https://yoursite.com/xmlrpc.php \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?>
<methodCall>
  <methodName>demo.sayHello</methodName>
</methodCall>'

You should receive a 403 Forbidden response.

Features

• Complete Blocking: Multiple methods to ensure XML-RPC is disabled
• Security Headers: Removes XML-RPC-related headers
• Jetpack Compatible: Option to keep Jetpack working
• Logging: Track XML-RPC access attempts
• Multiple Layers: PHP, .htaccess, and Nginx options
• Attack Prevention: Stops brute force and DDoS attacks via XML-RPC

When to Keep XML-RPC Enabled

Only keep XML-RPC enabled if you:

• Use Jetpack and need its features
• Use mobile apps to publish content
• Need pingback/trackback functionality
• Use third-party services that require XML-RPC

Otherwise, it's recommended to disable it for security.