Disable XML-RPC in WordPress without a plugin

What Disable XML-RPC does

Disable XML-RPC adds one filter that switches off the XML-RPC methods that need a login. The plugin on WordPress.org

What the snippet does the same

• It uses the same xmlrpc_enabled filter as the plugin, so remote publishing and password guessing through xmlrpc.php stop.
• There are no settings in either.
• Jetpack and older blogging apps that rely on XML-RPC stop working with both.

What's different

• The snippet goes further. It also removes every XML-RPC method, so pingbacks through xmlrpc.php stop too. The plugin leaves those methods on.
• The snippet removes the X-Pingback header and the RSD link from the page head. The plugin doesn't.
• Neither blocks xmlrpc.php at server level. Requests to it still load WordPress; your host can deny the file if you want that.

The snippet: Turn off XML-RPC

Blocks remote publishing, pingbacks and password guessing through xmlrpc.php. The block editor, the REST API and the WordPress apps don’t need it.

<?php

// Turn off XML-RPC. Nothing that uses xmlrpc.php works any more: remote
// publishing, pingbacks, and password guessing through it.
add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'xmlrpc_methods', static fn() => array() );

// Don't advertise it either.
add_filter(
	'wp_headers',
	static function ( $headers ) {
		unset( $headers['X-Pingback'] );
		return $headers;
	}
);
remove_action( 'wp_head', 'rsd_link' );

Notes, where it runs and what it was tested with

Switching from the plugin

1. Install the snippet in Snipfire (it arrives switched off).
2. Deactivate Disable XML-RPC.
3. Switch the snippet on. Snipfire checks the code and test-loads your site first.
4. Check the page it affects, then delete the plugin.