Disable XML-RPC

// Turn off XML-RPC, including pingbacks.
add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'xmlrpc_methods', '__return_empty_array' );

// Stop advertising the XML-RPC endpoint.
remove_action( 'wp_head', 'rsd_link' );
add_filter(
	'wp_headers',
	function ( $headers ) {
		unset( $headers['X-Pingback'] );
		return $headers;
	}
);

What it does

XML-RPC is an old way for apps to talk to WordPress. Most sites no longer use it, but bots still hit xmlrpc.php to guess passwords and send pingback spam.

This snippet removes every XML-RPC method, including pingbacks, removes the RSD link from your page head and drops the X-Pingback header.

Good to know

• Jetpack and some older publishing apps need XML-RPC. Don't use this snippet if you rely on them.
• Requests to xmlrpc.php still load WordPress. To block them before WordPress starts, ask your host to deny that file at server level.