Simple Disable XML-RPC

Simple Disable XML-RPC is a lightweight, battle-tested, and developer-friendly WordPress security plugin that provides comprehensive protection against XML-RPC vulnerabilities. Protect your WordPress site from brute force attacks, DDoS attempts, and resource exhaustion with a single click.

🔒 Why Disable XML-RPC?

XML-RPC is an obsolete remote communication protocol originally built for external desktop blogging applications. While historically useful, modern WordPress relies on the secure REST API. Today, XML-RPC is one of the most frequently exploited vectors for:

• Brute Force Attacks – Hackers execute system.multicall to attempt thousands of username and password combinations in a single HTTP request, completely bypassing basic login rate limiters.
• DDoS Amplification Attacks – Attackers abuse the pingback.ping method to turn thousands of vulnerable WordPress websites into botnet reflectors against targeted hosts.
• Server Resource Exhaustion – Continuous scans and exploit probes against /xmlrpc.php consume CPU cycles, MySQL connections, and memory.

✨ Key Features in Version 1.4.1

• 🎯 One-Click Master Switch – Instantly enable or disable XML-RPC via an accessible, modern toggle.
• 🛡️ Direct Request Blocker (HTTP 403) – Immediately terminates direct hits to xmlrpc.php with an HTTP 403 Forbidden status before full WordPress initialization, saving precious server resources.
• ⚡ Pingback DDoS Protection – Explicitly unregisters pingback.ping and pingback.extensions.getPingbacks methods.
• 🧹 Header Footprint Cleanup – Automatically removes the Really Simple Discovery (RSD / EditURI) and Windows Live Writer (wlwmanifest) links from your website’s <head>.
• 🚫 X-Pingback Stripper – Safely removes the X-Pingback HTTP header from all server responses.
• 🧪 Live Diagnostics & Self-Test Tool – Test your live xmlrpc.php endpoint directly from the admin dashboard to verify that your site is protected.
• ⭐ Recommended Plugins Hub – A dedicated menu showcasing all plugins by community contributor Delower Hossain (@wpdelower) with one-click AJAX install, activate, and deactivate.
• 🎨 Ultra-Professional Admin Interface – Modern card design, real-time status banners, live search filters, and smooth responsive layout.
• 🌐 Translation Ready – Fully internationalized and compatible with multilingual setups.
• 🧹 Complete Clean Uninstall – Cleans up all database options and transients on both single-site and multisite networks.

🆕 What’s New in Version 1.4.1

• 🚀 Recommended Plugins Section: Brand new submenu and tab featuring all WordPress plugins by Delower Hossain (@wpdelower) with instant AJAX installation, activation, and deactivation.
• 🔒 HTTP 403 Direct Request Blocker: Halts requests to xmlrpc.php early to avoid CPU spikes during DDoS and brute force scans.
• 🛡️ Pingback Security Hardening: Blocks pingback methods specifically to eliminate amplification vectors.
• 🧹 DOM & Header Cleanup: Strips rsd_link and wlwmanifest_link from <head>.
• 🧪 Live XML-RPC Diagnostic Tester: Built-in connection tester to verify endpoint status.
• 🎨 Elevated UI: Enterprise-grade header, protection badges, real-time status banner, and quick filter controls.
• ⚡ Modular Architecture: Clean separation into SDXRPC_Core, SDXRPC_Admin, and SDXRPC_Recommended.

🎯 Perfect For

• Security-conscious WordPress website owners.
• Websites experiencing XML-RPC brute force or high server load.
• Administrators who do not use the WordPress mobile app or legacy publishing tools.
• Agencies and developers managing client sites needing zero-overhead protection.

⚠️ Important Note

Disabling XML-RPC may affect:
* WordPress mobile apps
* Jetpack (features requiring XML-RPC)
* Remote XML-RPC publishing clients
* Trackbacks and pingbacks

If you do not utilize these services, disabling XML-RPC is strongly recommended.

🤝 Contributing & Bug Reports

Bug reports and pull requests are welcome on GitHub.

💝 Support the Development

If you find this plugin helpful:
* ⭐ Rate it 5 stars on WordPress.org
* 💬 Check out our other plugins

Privacy Policy

Simple Disable XML-RPC does not:
* Collect or store personal user data
* Track user activity or use tracking cookies
* Send personal data to third parties

The plugin only queries the official WordPress.org Plugins API when an administrator visits the Recommended Plugins page to display plugin updates and metrics.

Credits

Developed with ❤️ by Delower Hossain & MonarchWP

Contributors:
* wpdelower
* monarchwp23

Special thanks to all our users and contributors!