Disable XML-RPC (Crucial Security Fix)

XML-RPC is an old API often targeted by brute-force attacks. If you don’t use the WordPress mobile app or Jetpack, disable it immediately to reduce server load and risk.

add_filter( 'xmlrpc_enabled', '__return_false' );