Install
Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/kevinocasio/ocasio-disable-xml-rpc/releases/download/v1.0.0/ocasio-disable-xml-rpc.zipNo built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Lightweight WordPress plugin to completely disable XML-RPC and protect your website against brute-force attacks and pingback exploits.
Overview
The xmlrpc.php file is a frequent target for automated brute-force attacks and pingback amplification exploits. Ocasio Disable XML-RPC turns off the XML-RPC endpoint, blocks incoming direct requests with an immediate 403 Forbidden response, and removes pingback headers from server responses.
Features
- Block Direct XML-RPC Requests: Kills requests to
xmlrpc.phpinstantly before they reach your database. - Strip Pingback Headers: Removes
X-Pingbackheaders to prevent server reconnaissance and pingback relay exploits. - Zero Front-End Assets: Pure PHP execution with 0 bytes of extra CSS or JavaScript loaded on public pages.
- Ocasio Suite Integration: Toggle the tool on or off through the centralized Ocasio Plugins -> Dashboard.
Installation
- Download the latest
ocasio-disable-xml-rpc.zipfile from Releases. - In your WordPress admin dashboard, go to Plugins -> Add New Plugin -> Upload Plugin.
- Choose the downloaded
.zipfile and click Install Now. - Click Activate Plugin.
- Confirm protection under Ocasio Plugins -> Dashboard in your sidebar.
Author & Resources
- Author: Kevin Ocasio
- Plugin Page: Ocasio Disable XML-RPC on KevinOcasio.com
- WordPress Plugins: Free WordPress Plugin Directory
- Software Portfolio: Live Projects & Digital Assets
- Tools & Resources: Recommended Tech Stack & Tools
- License: GPL-2.0-or-later
Releases
1 release. Each count is every asset in that release; expand a row for the breakdown.
Tag
Published
Assets
Downloads