About this plugin
Simple Disable XML-RPC is a lightweight, battle-tested, and developer-friendly WordPress security plugin that provides comprehensive protection against XML-RPC vulnerabilities. Protect your WordPress site from brute force attacks, DDoS attempts, and resource exhaustion with a single click.
🔒 Why Disable XML-RPC?
XML-RPC is an obsolete remote communication protocol originally built for external desktop blogging applications. While historically useful, modern WordPress relies on the secure REST API. Today, XML-RPC is one of the most frequently exploited vectors for:
- Brute Force Attacks – Hackers execute system.multicall to attempt thousands of username and password combinations in a single HTTP request, completely bypassing basic login rate limiters.
- DDoS Amplification Attacks – Attackers abuse the pingback.ping method to turn thousands of vulnerable WordPress websites into botnet reflectors against targeted hosts.
- Server Resource Exhaustion – Continuous scans and exploit probes against /xmlrpc.php consume CPU cycles, MySQL connections, and memory.
✨ Key Features in Version 1.4.1
- 🎯 One-Click Master Switch – Instantly enable or disable XML-RPC via an accessible, modern toggle.
- 🛡️ Direct Request Blocker (HTTP 403) – Immediately terminates direct hits to xmlrpc.php with an HTTP 403 Forbidden status before full WordPress initialization, saving precious server resources.
- ⚡ Pingback DDoS Protection – Explicitly unregisters pingback.ping and pingback.extensions.getPingbacks methods.
- 🧹 Header Footprint Cleanup – Automatically removes the Really Simple Discovery (RSD / EditURI ) and Windows Live Writer ( wlwmanifest ) links from your website’s <head>.
- 🚫 X-Pingback Stripper – Safely removes the X-Pingback HTTP header from all server responses.
- 🧪 Live Diagnostics & Self-Test Tool – Test your live xmlrpc.php endpoint directly from the admin dashboard to verify that your site is protected.
- ⭐ Recommended Plugins Hub – A dedicated menu showcasing all plugins by community contributor Delower Hossain (@wpdelower) with one-click AJAX install, activate, and deactivate.
- 🎨 Ultra-Professional Admin Interface – Modern card design, real-time status banners, live search filters, and smooth responsive layout.
- 🌐 Translation Ready – Fully internationalized and compatible with multilingual setups.
- 🧹 Complete Clean Uninstall – Cleans up all database options and transients on both single-site and multisite networks.
🆕 What’s New in Version 1.4.1
- 🚀 Recommended Plugins Section: Brand new submenu and tab featuring all WordPress plugins by Delower Hossain (@wpdelower) with instant AJAX installation, activation, and deactivation.
- 🔒 HTTP 403 Direct Request Blocker: Halts requests to xmlrpc.php early to avoid CPU spikes during DDoS and brute force scans.
- 🛡️ Pingback Security Hardening: Blocks pingback methods specifically to eliminate amplification vectors.
- 🧹 DOM & Header Cleanup: Strips rsd_link and wlwmanifest_link from <head>.
- 🧪 Live XML-RPC Diagnostic Tester: Built-in connection tester to verify endpoint status.
- 🎨 Elevated UI: Enterprise-grade header, protection badges, real-time status banner, and quick filter controls.
- ⚡ Modular Architecture: Clean separation into SDXRPC_Core, SDXRPC_Admin, and SDXRPC_Recommended.
🎯 Perfect For
- Security-conscious WordPress website owners.
- Websites experiencing XML-RPC brute force or high server load.
- Administrators who do not use the WordPress mobile app or legacy publishing tools.
- Agencies and developers managing client sites needing zero-overhead protection.
⚠️ Important Note
Disabling XML-RPC may affect:
* WordPress mobile apps
* Jetpack (features requiring XML-RPC)
* Remote XML-RPC publishing clients
* Trackbacks and pingbacks
If you do not utilize these services, disabling XML-RPC is strongly recommended.
🤝 Contributing & Bug Reports
Bug reports and pull requests are welcome on GitHub.
💝 Support the Development
If you find this plugin helpful:
org
* 💬 Check out our other plugins
Privacy Policy
Simple Disable XML-RPC does not:
* Collect or store personal user data
* Track user activity or use tracking cookies
* Send personal data to third parties
org Plugins API when an administrator visits the Recommended Plugins page to display plugin updates and metrics.
Credits
Developed with ❤️ by Delower Hossain & MonarchWP
Contributors:
* wpdelower
* monarchwp23
Special thanks to all our users and contributors!