JPKCom DB
View on GitHub

JPKCom Disable XML-RPC — Guide & Tips

Disable WordPress XML-RPC site-wide with JPKCom Disable XML-RPC — installation, requirements and security tips.

JPKCom Disable XML-RPC disables the WordPress XML-RPC interface globally. Useful when you don't need this legacy remote interface and want to close its attack surface.

Guide

Requirements

  • WordPress 6.9 or newer (tested up to WordPress 7.1)
  • PHP 8.3 or newer

Installation

  1. In your admin panel, go to Plugins → Add New and click Upload Plugin.
  2. Choose the plugin's ZIP file and click Install Now.
  3. Click Activate.

How it works

There is no settings page — once active, the plugin disables XML-RPC for the entire installation:

  • Requests to xmlrpc.php are answered with HTTP 403 and an XML-RPC fault, so clients get a parseable refusal rather than a silent empty response.
  • The xmlrpc_enabled flag is off, the method list is empty, and instantiation of the XML-RPC server class is blocked as a last resort.
  • The site stops advertising the endpoint: neither the X-Pingback HTTP header nor a <link rel="pingback"> tag is emitted any more.

Please note: pingbacks arrive over XML-RPC and are therefore no longer accepted. Because WordPress gates both mechanisms on the same pings_open() check, trackbacks are refused as well.

Tips & Tricks

  • Reduce attack surface: XML-RPC is a common entry point for brute-force and pingback attacks. If you don't use services that strictly require XML-RPC, you can safely disable the interface.
  • Check what relies on XML-RPC first: Some external services or older app integrations still talk to WordPress via XML-RPC. Make sure you don't rely on such an integration before disabling it globally.
  • Trackbacks included: If you deliberately want to keep trackbacks, this plugin is the wrong choice — since version 1.0.9 they go away together with the pingbacks.
  • 403 instead of 200 since 1.0.9: Up to version 1.0.8 xmlrpc.php answered with a bare HTTP 200 and an empty body instead of the documented 403. If you verify the shutdown via monitoring or a security scan, your test should expect a different status code from 1.0.9 on.
  • Reproducible updates: Since version 1.0.2 the plugin uses secure self-hosted updates via GitHub with SHA256 checksums, runs with declare(strict_types=1), types the callbacks and sanitizes $_SERVER access.

Further reading