#109 by installs
SiteGuard WP Plugin
Adds WordPress login and admin protections, including CAPTCHA, login lock, login alerts, renamed login URLs, and SiteGuard WAF tuning support.
- Installs
- 600,000+
- Rating
- 4.3 (15)
- Updated
- 4 days ago
Disable XML-RPC-API
A simple and lightweight plugin to disable XML-RPC API, X-Pingback and pingback-ping in WordPress 3.5+ for a faster and more secure website
- Active installs
- 100,000+
- #388 of 1,000
- Downloads, all time
- 835.6K
- 835,570
- Downloads, 30 days
- 7.1K
- 1.9K in the last 7
- Rating
- 4.2 / 5
- 43 reviews
- Last updated
- 9 months ago
- Feb 4, 2026
- Version
- 2.1.7
- 23 releases
Upkeep and compatibility
| Last updated | February 4, 2026Updated in the last year |
|---|---|
| Tested up to | WordPress 6.9.11Older than WordPress 7.1.4, the current release |
| Needs WordPress | 5.0 or newer |
| Needs PHP | Not stated |
| First published | October 1, 2020 |
| Support, last two months | 0 of 1 threads resolved (0%) |
Reviews
4.2 / 5 from 43 reviews
| 5 stars | 33 |
|---|---|
| 4 stars | 0 |
| 3 stars | 1 |
| 2 stars | 2 |
| 1 star | 7 |
Downloads, last 30 days
What the author says it does
Protect your website from xmlrpc brute-force attacks,DOS and DDOS attacks, this plugin disables the XML-RPC and trackbacks-pingbacks on your WordPress website.
PLUGIN FEATURES
(These are options you can enable or disable each one)
- Disable access to xmlrpc.php file using .httacess file
- Automatically change htaccess file permission to read-only (0444)
- Disable X-pingback to minimize CPU usage
- Disable selected methods from XML-RPC
- Remove pingback-ping link from header
- Disable trackbacks and pingbacks to avoid spammers and hackers
- Rename XML-RPC slug to whatever you want
- Black list IPs for XML-RPC
- White list IPs for XML-RPC
- Some options to speed-up your wordpress website
- Disable JSON REST API
- Hide WordPress Version
- Disable built-in WordPress file editor
- Disable wlw manifest
- And some other options
What is XMLRPC
XML-RPC, or XML Remote Procedure Call is a protocol which uses XML to encode its calls and HTTP as a transport mechanism.
Beginning in WordPress 3.5, XML-RPC is enabled by default. Additionally, the option to disable/enable XML-RPC was removed. For various reasons, site owners may wish to disable this functionality. This plugin provides an easy way to do so.
Why you should disable XML-RPC
Xmlrpc has two main weaknesses
- Brute force attacks:
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
Is there an admin interface for this plugin?
Yes, You can find the “XML-RPC Security” in your admin menu.
How do I know if the plugin is working?
There are three easy methods for checking if XML-RPC is off:
1. Easiest way is going to this url: http://yourdomain/xmlrpc.php enter your domain name instead of ‘yourdomain’ if you see “Access forbidden!” or “403 error” it’s working.
Something doesn’t seem to be working correctly
If the plugin is activated, but XML-RPC appears to still be working … OR … the plugin is deactivated, but XML-RPC is not working, then it’s possible that another plugin or theme function is affecting the plugin functions.
Latest changelog entry
- Initial release
Screenshots
Tagged
Plugins that share its tags
#262 by installs
Disable XML-RPC
Disables the XML-RPC API in WordPress 3.5+, which is enabled by default.
- Installs
- 200,000+
- Rating
- 4.1 (34)
- Updated
- 5 months ago
#667 by installs
Disable XML-RPC Pingback
Stops abuse of your site's XML-RPC by simply removing some methods used by attackers. While you can use the rest of XML-RPC methods.
- Installs
- 60,000+
- Rating
- 3.9 (14)
- Updated
- 11 months ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin. The author takes donations at their donate page.