WP Manifestindependent plugin directory
manifest / security / pp-disable-xml-rpc

Disable XML-RPC by Progress Planner

Disable XML-RPC by ProgressPlanner

by Team Emilia Projects · github.com/progressplanner/pp-disable-xml-rpc · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/progressplanner/pp-disable-xml-rpc/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/progressplanner/pp-disable-xml-rpc ↗

Disable XML-RPC banner

A lightweight WordPress plugin that disables XML-RPC completely, helping reduce attack surface and block unwanted XML-RPC access with zero configuration.

Why use this plugin?

If your site does not rely on XML-RPC, leaving it enabled serves little purpose and can create unnecessary exposure. This plugin turns XML-RPC off in a minimal, focused way.

Benefits

  • Disables XML-RPC for WordPress sites that do not need it
  • Returns a 403 response for XML-RPC requests
  • Works immediately after activation
  • No settings page, setup wizard, or maintenance overhead
  • Tiny codebase with a single, clear purpose

Who is this for?

This plugin is a good fit for:

  • site owners who do not use XML-RPC-based publishing or integrations
  • agencies and developers hardening client sites
  • WordPress installs where XML-RPC is not part of the workflow

Important compatibility note

Do not use this plugin if your site depends on XML-RPC for publishing or integrations. Disabling XML-RPC can affect tools or services that still rely on it.

Installation

From WordPress admin

  1. Go to Plugins → Add New.
  2. Search for Disable XML-RPC by Progress Planner.
  3. Install and activate the plugin.

From GitHub or a ZIP file

  1. Download this repository as a ZIP.
  2. Upload it via Plugins → Add New → Upload Plugin.
  3. Activate the plugin.

What happens after activation?

Once activated, the plugin:

  • disables WordPress XML-RPC through the relevant filter
  • blocks XML-RPC requests directly
  • shows a clear “XML-RPC Disabled” response when access is attempted

There are no settings to configure.

Frequently asked questions

Does this plugin have a settings page?

No. It is intentionally configuration-free.

Will this improve security?

It can help reduce exposure on sites that do not need XML-RPC. Like any hardening step, it should be part of a broader security strategy.

Will this break anything?

It may, if you use a service, app, or workflow that still depends on XML-RPC. Review your stack before activating it on production sites.

Development

This is a deliberately small utility plugin. If you want to review behavior, start with:

  • pp-disable-xml-rpc.php

License

MIT. See LICENSE.

These cannot be fully managed from files alone, but they will improve the repository page:

  • Description: Disable WordPress XML-RPC completely with a lightweight, no-settings plugin.
  • Website: https://progressplanner.com/
  • Topics: wordpress, wordpress-plugin, xml-rpc, security, hardening, site-security, progress-planner
  • Social preview: Use .wordpress.org/banner-1544x500.png or create a 1280×640 social card based on the existing banner