Disable XML-RPC in WordPress (Crucial Security Fix)

XML-RPC is a legacy WordPress API that can be targeted by brute-force attacks and pingback abuse. If your site does not rely on the WordPress mobile app or Jetpack, you can disable it with a single filter.

Add this snippet to a child theme’s functions.php file or use a code snippet plugin.

The snippet

add_filter( 'xmlrpc_enabled', '__return_false' );

This disables authenticated XML-RPC methods through WordPress’s native filter. It does not delete the xmlrpc.php file, so server-level requests can still receive a response even though XML-RPC methods are disabled.

Before you disable it

Check whether the site depends on any XML-RPC-based integration first. The WordPress mobile app, Jetpack features, and some older publishing tools may require it. If one of those integrations is active, disabling XML-RPC can prevent it from connecting.

For a site that does not use those integrations, this small hardening step removes an old API surface without adding another plugin.