Disable XML-RPC in WordPress (Crucial Security Fix)

XML-RPC is a legacy WordPress API that lets external clients call WordPress through xmlrpc.php. It can be useful for the WordPress mobile app and Jetpack, but it is also a common target for brute-force amplification and pingback abuse. If your site does not rely on an XML-RPC integration, disable it at the WordPress level without adding another plugin.

Add this snippet to a child theme’s functions.php file or use a code snippet plugin.

The snippet

add_filter( 'xmlrpc_enabled', '__return_false' );

This disables authenticated XML-RPC methods through WordPress’s native filter. It does not delete the xmlrpc.php file, so a request can still reach that file and receive a response even though XML-RPC methods are disabled.

Optional pingback hardening

If the site does not use pingbacks, remove the pingback URL from generated responses as well:

add_filter( 'bloginfo_url', function( $output, $show ) {
  return 'pingback_url' === $show ? '' : $output;
}, 10, 2 );

add_filter( 'xmlrpc_methods', function( $methods ) {
  unset( $methods['pingback.ping'], $methods['pingback.extensions.getPingbacks'] );
  return $methods;
} );

Before you disable it

Check whether the site depends on any XML-RPC-based integration first. The WordPress mobile app, Jetpack features, and some older publishing tools may require it. If one of those integrations is active, disabling XML-RPC can prevent it from connecting. The WordPress XML-RPC documentation explains the compatibility trade-off.

This is application-level hardening, not a replacement for rate limiting, strong passwords, two-factor authentication, or server-level request controls. To remove the endpoint from the web server entirely, add a server rule only after confirming that no integration needs it.

For another plugin-free hardening step, see how to hide WordPress version and generator tags.