Cookie settings

Choose which cookies we can use. You can change this at any time from “Cookie settings” in the footer. See our cookie policy for details.

Essential

Needed for the site to work, such as remembering your cookie choices. These can’t be switched off.

Always on

Help us understand which pages are visited and how people find us (Google Analytics). Off unless you turn it on.

Skip to content
New in 3.4.0 8 new features and 16 fixes November special 20% off every Pro plan with code NOVEMBER20 Black Friday 50% off every Pro plan until Sunday 29 November
WP Extended Modular WordPress toolkit , home
Disable XML-RPC Free

Disable XML-RPC in WordPress

Switch off xmlrpc.php, the old remote publishing endpoint that attackers use to try many passwords in a single request.

Download free or read the Disable XML-RPC docs

Free on WordPress.org, with nothing locked behind Pro.

in the free plugin
Free
updates since 2024
4
last improved in
3.3.0
Security & Privacy modules
9
A photographer in her studio with WP Extended open on a desktop monitor

Why you need Disable XML-RPC

XML-RPC predates the REST API and most sites no longer need it. It still accepts login attempts, often outside the limits a login plugin sets on wp-login.php.

What Disable XML-RPC does

  • Endpoint closed Requests to XML-RPC are refused.

Where Disable XML-RPC helps

  • An account manager walking a client through WP Extended on a laptop in a café

    Any site not using the old mobile app or Jetpack

    Close an attack route that nothing on the site uses.

WP Extended vs the Disable XML-RPC plugin

The Disable XML-RPC plugin has 200k+ active installs on WordPress.org. If you only need this one job, that’s a fine choice. If the site also needs other modules on this list, it’s one less plugin to update.

The difference
Disable XML-RPC does the same core job inside WP Extended, so it shares one settings screen, one update and one support team with every other module you use.

Recent changes

The latest updates to Disable XML-RPC, from the WP Extended changelog.

Full changelog
  1. v3.3.0 10 Sept 2026
    • fixed

      The content-type check was inconsistent.

  2. v3.2.4 5 Mar 2026
    • fixed

      Refined XML-RPC request handling.

  3. v3.1.0 22 Sept 2025
    • fixed

      Resolved issue where XML-RPC wasn't always disabled.

  4. v3.0.7 5 Aug 2024
    • improved

      Disable XML-RPC – Use built-in WordPress return false function.

Disable XML-RPC questions

Disable XML-RPC documentation

Yes. It is in the free plugin.

Only tools that still use XML-RPC, such as some older remote publishing apps and certain Jetpack features. Check before enabling it on a site that uses them.

Pairs well with

All Security & Privacy

Get Disable XML-RPC free

Disable XML-RPC is in the free plugin on WordPress.org, alongside 34 other free modules you can switch on when you need them.

Download free See Pro pricing

Pro from $29 a year · 14-day money-back guarantee