Disable XML-RPC

The Disable XML-RPC module increases WordPress security by blocking the XML-RPC interface, a common target for brute-force and DDoS attacks. With one click, you can disable external access, prevent pingback exploits, and reduce your site’s attack surface—without extra plugins or coding.

How to use

To enable the Disable XML-RPC Module:

1. Click on the “Security” category
2. Search or scroll to locate the Disable XML-RPC Module
3. Click on the switch to enable

What’s next?

This module will disable the XML-RPC interface in WordPress. Here’s what happens when enabled:

1. What’s Disabled

• XML-RPC API: All XML-RPC requests will be blocked
• Pingbacks/Trackbacks: Disabled as they rely on XML-RPC
• External App Access: Apps using XML-RPC will no longer connect

2. Security Benefits

• Prevents DDoS attacks that abuse XML-RPC
• Blocks brute force login attempts through XML-RPC
• Reduces the attack surface of your website
• Protects against XML-RPC pingback attacks

3. What This Affects

• Mobile Apps: WordPress mobile apps won’t be able to connect
• Jetpack: Some Jetpack features may be affected
• Remote Publishing: Tools that publish to your site remotely
• Trackbacks/Pingbacks: These will no longer function

4. Customization

The module provides a filter to customize the behavior:

Allow XML-RPC for specific IPs: 
add_filter('WPMazic/disable-xmlrpc/allow_ips', function($ips) {
    $ips[] = '123.456.789.0'; // Add allowed IP
    return $ips;
});

Completely disable the module's functionality: 
add_filter('WPMazic/disable-xmlrpc/disabled', '__return_false');

5. Re-enabling XML-RPC

To restore XML-RPC functionality:

1. Go back to the Disable XML-RPC Module
2. Click the switch to disable the module

Important Notes:

• This module is enabled by default for security reasons
• Most modern websites don’t require XML-RPC functionality
• If you use the WordPress mobile app or Jetpack, you may need to whitelist your IP
• Some caching plugins may need their cache cleared after changing these settings

Troubleshooting:

If you experience issues:

1. Check if any plugins rely on XML-RPC
2. Verify your IP is whitelisted if needed
3. Clear your site and browser cache
4. Test XML-RPC access using a tool like Postman

Alternative Approach:

If you need to allow specific XML-RPC methods while blocking others, you can use this filter:

add_filter('xmlrpc_methods', function($methods) {
    // Uncomment and modify to allow specific methods
    // $allowed_methods = ['wp.getUsersBlogs', 'demo.sayHello'];
    // return array_intersect_key($methods, array_flip($allowed_methods));
    
    // Or block specific methods
    unset($methods['pingback.ping']);
    unset($methods['pingback.extensions.getPingbacks']);
    return $methods;
}, 10, 1);