Active installations20Adoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records Disable XML-RPC – Dashboard Control version 1.0.4 as active, updated 1mo ago and tested up to WordPress 7.1.
Overview
About this plugin
This plugin allows you to quickly toggle on/off XML-RPC functionality from the Dashboard
On initial installation and activation, XML-RPC will be disabled,
It displays the current enabled/disabled status in the dashboard, helping users avoid leaving access on unnecessarily.
It features XML-RPC rate limiting functionality, providing some protection to users while XML-RPC is on.
Rate limiting is on by default, but can be turned off. Note that it’s not perfect security however, and we recommend XML-RPC is disabled after use.
Why Control XML-RPC?
XML-RPC is a WordPress feature that allows remote access to your site. While useful for legitimate applications like mobile apps and remote publishing, it’s frequently exploited for:
Brute force password attacks
DDoS amplification attacks via pingbacks
Spam distribution
Resource exhaustion
Rate Limiting Protection
When enabled, the plugin automatically limits:
Failed Authentication – Maximum 5 failed login attempts per hour per IP
High-Risk Methods – Limits on pingback.ping, system.multicall, and other abuse-prone methods
IP Validation – Validates addresses and processes proxy headers correctly. Sites where the client connects directly are protected against IP spoofing automatically; sites behind a reverse proxy or CDN can declare their proxies via the xmlrpc_control_trusted_proxies filter so forwarded headers are only trusted from those addresses
Privacy
This plugin does not collect, store, or transmit any user data outside your WordPress installation. All rate limiting data is stored temporarily using WordPress transients and is automatically cleaned up.
Additional Information
Support
For support, feature requests, or bug reports, please visit the plugin’s support forum.
Contributing
Feedback is welcome.
Security
If you discover a security vulnerability, please report it responsibly via the WordPress security team or directly to the plugin author.
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
rate limiting
dashboard
security
xmlrpc
Compatibility & maintenance
Compatibility & maintenance
Tested with WP 7.1
Marked as tested with the current WordPress 7.1 release.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to7.1
Minimum requirementsWordPress 5.0 · PHP 7.4
Update activity10 Sept 20261mo ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
Version1.0.3→1.0.4
WordPress compatibility7.0.4→7.1
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
