#388 by installs
Disable XML-RPC-API
A simple and lightweight plugin to disable XML-RPC API, X-Pingback and pingback-ping in WordPress 3.5+ for a faster and more secure website
- Installs
- 100,000+
- Rating
- 4.2 (43)
- Updated
- 9 months ago
Disable XML-RPC
Disables the XML-RPC API in WordPress 3.5+, which is enabled by default.
- Active installs
- 200,000+
- #262 of 1,000
- Downloads, all time
- 672.1K
- 672,081
- Downloads, 30 days
- 7.3K
- 1.6K in the last 7
- Rating
- 4.1 / 5
- 34 reviews
- Last updated
- 5 months ago
- May 27, 2026
- Version
- 1.0.1
- 3 releases
Upkeep and compatibility
| Last updated | May 27, 2026Updated in the last year |
|---|---|
| Tested up to | WordPress 7.0.8Older than WordPress 7.1.4, the current release |
| Needs WordPress | 3.5 or newer |
| Needs PHP | Not stated |
| First published | September 28, 2012 |
| Support, last two months | No threads opened |
Reviews
4.1 / 5 from 34 reviews
| 5 stars | 26 |
|---|---|
| 4 stars | 0 |
| 3 stars | 0 |
| 2 stars | 1 |
| 1 star | 7 |
Downloads, last 30 days
What the author says it does
Pretty simply, this plugin uses the built-in WordPress filter “xmlrpc_enabled” to disable the XML-RPC API on a WordPress site running 3.5 or above.
Beginning in 3.5, XML-RPC is enabled by default. Additionally, the option to disable/enable XML-RPC was removed. For various reasons, site owners may wish to disable this functionality. This plugin provides an easy way to do so.
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
Is there an admin interface for this plugin?
No. This plugin is as simple as XML-RPC is off (plugin activated) or XML-RPC is on (plugin is deactivated).
How do I know if the plugin is working?
There are a few easy methods for checking if XML-RPC is off:
- Try using an XML-RPC WordPress client, like the official WordPress mobile apps. The WordPress mobile app should tell you that “XML-RPC services are disabled on this site” if the plugin is activated.
Something doesn’t seem to be working correctly
If the plugin is activated, but XML-RPC appears to still be working … OR … the plugin is deactivated, but XML-RPC is not working, then it’s possible that another plugin or theme function is affecting the xmlrpc_enabled filter. Additionally, server configurations could be blocking XML-RPC (i.e. blocking access to xmlrpc.php in the .htaccess file).
Latest changelog entry
- Blank lines removed from the plugin file.
Screenshots
An example of the error that the WordPress mobile app will return when this plugin is enabled. This is expected and indicates that the… 
An example of a curl command attempting to request data via XML-RPC calls to the site when the plugin is enabled. The error "XML-RPC… 
An example of the XML-RPC validator run against the site when the plugin is enabled. The error "Method not allowed" is expected and…
Tagged
Plugins that share its tags
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.