Remove all methods from the WordPress XML-RPC API.
| Author: | Walter Ebert (profile at wordpress.org) |
| WordPress version required: | 4.6 |
| WordPress version tested: | 6.9 |
| Plugin version: | 1.4.1 |
| Added to WordPress repository: | 10-02-2020 |
| Last updated: | 02-12-2025 |
| Rating, %: | 100 |
| Rated by: | 2 |
| Plugin URI: | https://gitlab.com/walterebert/wee-remove-xml... |
| Total downloads: | 11 230 |
| Active installs: | 1 000+ |
 Click to start download |
|
This plugin does more than just using the xmlrpc_enabled hook, because that is only used “To disable XML-RPC methods that require authentication”.
Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC.
It works with any webserver, because it does not use the .htaccess file.
Testing the plugin
From the command line you can test if the plugin is working correctly using cURL. Replace the example.com link to match your website:
curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params><param><value><string/></value></param></params></methodCall>' https://example.com/xmlrpc.php
This should only return the following methods:
– system.multicall
– system.listMethods
– system.getCapabilities
ChangeLog