Wordpress: Disable XML-RPC in WordPress

Secure your WordPress site by disabling XML-RPC with this simple snippet, reducing vulnerability to brute force attacks and improving performance.

Disabling XML-RPC can enhance your WordPress site's security by preventing external XML-RPC requests that are often used in brute force attacks. This snippet disables XML-RPC effectively.

The xmlrpc_enabled filter is used to return false, which disables XML-RPC capabilities on your site. This simple method blocks external applications from performing remote actions.

This snippet explains the security benefits of disabling XML-RPC, including reducing the attack surface of your WordPress site and potentially improving its performance by eliminating unnecessary external calls.

Considerations for sites that might need XML-RPC for legitimate purposes, such as connecting to third-party applications, are discussed. Alternatives and workarounds are provided for those cases.

Lastly, the snippet includes guidance on how to check if XML-RPC is disabled on your site and how to handle any potential issues that might arise after disabling it.

Snippet Code

Version Compatibility

This code is compatible with WordPress 3.5 and later, which supports the xmlrpc_enabled filter.

Required PHP Version

PHP 5.3 or higher

Wordpress Core Functions Used

add_filter

Use Cases

security enhancements
performance optimization
API management