Active installations30Adoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records XML-RPC Settings version 1.2.1 as active, updated 4y ago and tested up to WordPress 5.8.
Overview
About this plugin
XML-RPC Settings
Configure XML-RPC methods to increase the security of your website:
Build-in features could be used for malicious purposes and cannot be disabled by default.
Disable GET access
XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.
Disable system.multicall
system.multicall method can be misused for amplification attacks.
Disable system.listMethods
system.listMethods method can be used for verifying attack scope.
Prevent malicious actors from enumerating usernames and credentials.
Disable authenticated methods
Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.
Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.
Disable pingbacks
Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.
Remove X-Pingback header
If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.
Hide WordPress version when verifying pingbacks
Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.
Hide WordPress version when sending pingbacks
Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.
Unnecessary XML-RPC API, leave enabled if you are not sure.
Disable Demo API
Remove demo.sayHello and demo.addTwoNumbers methods, as they are not needed.
Disable Blogger API
WordPress supports the Blogger XML-RPC API methods.
Disable MetaWeblog API
WordPress supports the metaWeblog XML-RPC API.
Disable MovableType API
WordPress supports the MovableType XML-RPC API.
If you are using some integrations or WP mobile applications, it might be a good idea to allow XML-RPC only to specific IPs.
Allow XML-RPC only for
IP comma separated eg. 192.168.10.242, 192.168.10.241
It is possible to hide a message between the allowed methods when system.listMethods is called (not recommended).
Add message to XML-RPC methods
We are hiring! Check jobs.yourdomains.com
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
brute force
ddos
security
xmlrpc
Compatibility & maintenance
Compatibility & maintenance
Tested up to WordPress 5.8
Not yet marked as tested with WordPress 7.1. WordPress.org currently lists Tested up to 5.8.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to5.8
Minimum requirementsWordPress 3.9 · PHP 5.3
Update activity25 Nov 20214y ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
No tracked version or compatibility changes have been recorded by WP PlugIndex yet.
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
