Itineris Disable XML-RPC
Disable WordPress XML-RPC via actions and filters.
by Itineris Limited · github.com/itinerisltd/itineris-disable-xml-rpc · website
★ 6stars
34kcomposer installs
2forks
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/itinerisltd/itineris-disable-xml-rpc/archive/refs/heads/master.zipAlso on Packagist as itinerisltd/itineris-disable-xml-rpc:
composer require itinerisltd/itineris-disable-xml-rpcFrom the readme
Itineris Disable XML-RPC
- Goal
- Why disable WordPress XML-RPC?
- How?
- Requirements
- Installation
- Alternative Installation
- Known Issues
- Incompatible Plugins
- FAQs
- Can I use this with Trellis?
- Will you add support for older PHP versions?
- It looks awesome. Where can I find some more goodies like this?
- This isn't on wp.org. Where can I give a ⭐️⭐️⭐️⭐️⭐️ review?
- Feedback
- Change Log
- Security
- Credits
- License
Goal
Disable WordPress XML-RPC (i.e: /wp/xmlrpc.php) via actions and filters.
Especially for those who can't control their servers, for example: Kinsta, WP Engine or other managed hosting.
Why disable WordPress XML-RPC?
- Kinsta: What is WordPress XML-RPC and How To Stop an Attack
- WPMU DEV: XML-RPC and Why It’s Time to Remove it for WordPress Security
- Sucuri: New Brute Force Attacks Exploiting XMLRPC in WordPress
- Incapsula: WordPress Default Leaves Millions of Sites Exploitable for DDoS Attacks
- LittleBizzy: How (And Why) To Disable WordPress XML-RPC
How?
Using actions and filters:
- xmlrpcenabled
Disable all XML-RPC methods which require authentication.
Note: The name is misleading!
- xmlrpcmethods
Remove all built-in/thir