'disable_xmlrpc', 'title' => 'Disable XML-RPC', 'desc' => 'Block xmlrpc.php, an endpoint often used for password guessing', 'icon' => 'lock', 'risk' => 'recommended', 'level' => 'standard', 'audience' => 'everyone', 'priority' => 8, 'benefit' => 'xmlrpc.php accepts usernames and passwords, and a single request can try many passwords at once, so it is a frequent target of automated attacks. Blocking it removes that route if nothing on your site needs it.', 'help' => 'XML-RPC is an older way for apps and services to work with WordPress remotely. Jetpack and some older apps still use it; most sites do not need it. With this on, every request to xmlrpc.php gets a 403 response, and the RSD link that points to it is removed from the page head.', 'before' => 'xmlrpc.php accepts requests from anyone', 'after' => 'Every request to xmlrpc.php gets a 403 Forbidden response.', 'detect' => function () { $jetpack = is_plugin_active( 'jetpack/jetpack.php' ); if ( $jetpack ) { return array( 'detected' => true, 'message' => 'Jetpack active — XML-RPC may be needed', 'safe' => false, ); } return array( 'detected' => true, 'message' => 'XML-RPC endpoint is active and exposed', 'safe' => true, 'savings' => 'Security improvement', ); }, 'callback' => function () { // Disable via filters (authenticated calls). add_filter( 'xmlrpc_enabled', '__return_false' ); add_filter( 'xmlrpc_methods', '__return_empty_array' ); // Block ALL requests to xmlrpc.php (GET + POST) early. add_action( 'init', function () { $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : ''; if ( strpos( $request_uri, 'xmlrpc.php' ) !== false ) { header( 'HTTP/1.1 403 Forbidden' ); header( 'X-Robots-Tag: noindex' ); echo 'faultCode405faultStringXML-RPC is disabled.'; exit; } }, 1 ); // Remove xmlrpc discovery link. remove_action( 'wp_head', 'rsd_link' ); }, );