WP Manifestindependent plugin directory
manifest / security / ocasio-disable-xml-rpc

Ocasio Disable XML-RPC

Blocks the XML-RPC endpoint to protect your website against brute-force login attacks and pingback exploits.

by Kevin Ocasio · github.com/kevinocasio/ocasio-disable-xml-rpc · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/kevinocasio/ocasio-disable-xml-rpc/archive/refs/heads/main.zip
Readme github.com/kevinocasio/ocasio-disable-xml-rpc ↗

Lightweight WordPress plugin to completely disable XML-RPC and protect your website against brute-force attacks and pingback exploits.

Overview

The xmlrpc.php file is a frequent target for automated brute-force attacks and pingback amplification exploits. Ocasio Disable XML-RPC turns off the XML-RPC endpoint, blocks incoming direct requests with an immediate 403 Forbidden response, and removes pingback headers from server responses.

Features

  • Block Direct XML-RPC Requests: Kills requests to xmlrpc.php instantly before they reach your database.
  • Strip Pingback Headers: Removes X-Pingback headers to prevent server reconnaissance and pingback relay exploits.
  • Zero Front-End Assets: Pure PHP execution with 0 bytes of extra CSS or JavaScript loaded on public pages.
  • Ocasio Suite Integration: Toggle the tool on or off through the centralized Ocasio Plugins -> Dashboard.

Installation

  1. Download the latest ocasio-disable-xml-rpc.zip file from Releases.
  2. In your WordPress admin dashboard, go to Plugins -> Add New Plugin -> Upload Plugin.
  3. Choose the downloaded .zip file and click Install Now.
  4. Click Activate Plugin.
  5. Confirm protection under Ocasio Plugins -> Dashboard in your sidebar.

Author & Resources