Disable XML-RPC-APIv2.1.7
A simple and lightweight plugin to disable XML-RPC API, X-Pingback and pingback-ping in WordPress 3.5+ for a faster and more secure website
Alternatives to Extended API over XMLRPC
Plugins below are selected for functional relevance and current directory signals. Active-install counts do not affect this ranking.
Relevant replacements
WordPress plugins with similar use cases
Compatibility and update metadata provide context, not a quality guarantee. Review each plugin’s details for your site.
Authyo Passwordless Loginv1.0.11
WordPress login security with brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, and passwordless OTP login.
Remove XML-RPC Methodsv1.4.2
Remove all WordPress methods from the XML-RPC API to increase security.
Disables the XMP-RPC API service introduced in WordPress 3.5 and above.
Simple Disable XML-RPCv1.4.1
Safely disable XML-RPC, block attacks with HTTP 403, stop pingback DDoS, and protect your WordPress site with a single click.
Fixora Disable XML-RPCv1.0.1
Fixora disable xml-rpc and xmlrpc pingback with a blocked-attempt log—see recent blocks in Settings.
GhostGatev1.3.3
Invisible, intelligent protection for WordPress. GhostGate hides your login page, blocks bots, and turns your site into a ghost fortress.
Flex Website Securityv1.2.4
Practical WordPress hardening: login limits, XML-RPC, headers, enumeration protection, and more.
Lightweight attack detection for WordPress. Logs brute force, XML-RPC abuse, SQL injection, XSS attempts and more. No bloat, no blocking — just data.
Quickly toggle XML-RPC on/off from your dashboard. Perfect for temporarily enabling access for mobile apps, then securing your site again.