Turn off XML-RPC
Blocks remote publishing, pingbacks and password guessing through xmlrpc.php. The block editor, the REST API and the WordPress apps don’t need it.
<?php
// Turn off XML-RPC. Nothing that uses xmlrpc.php works any more: remote
// publishing, pingbacks, and password guessing through it.
add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'xmlrpc_methods', static fn() => array() );
// Don't advertise it either.
add_filter(
'wp_headers',
static function ( $headers ) {
unset( $headers['X-Pingback'] );
return $headers;
}
);
remove_action( 'wp_head', 'rsd_link' );
Good to know
Jetpack and some older desktop blogging apps still use XML-RPC. Leave this off if you use them.
In these packs
- Harden WordPress: Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors.