Skip to content
WP PowerSuiteWP PowerSuite Docs

Quick navigation

Popular modules

Browse by category

Security19/19Login & UserssoonAdminsoonContentsoonMediasoonSEO & VisibilitysoonSpeedsoonSite Toolssoon
↑↓ navigate↵ openesc close154 guides · 154 modules

Disable XML-RPC

Disable XML-RPC closes the old XML-RPC channel many password-guessing tools still target. Fine for most sites; skip if you rely on legacy apps or remote publishing that need it.

What it does

Section titled “What it does”
  • Direct xmlrpc.php (and some /xmlrpc paths) receive HTTP 403 with an XML error: “XML-RPC services are disabled.”
  • Forces xmlrpc_enabled to false and empties registered xmlrpc_methods.
  • Removes rsd_link and wlwmanifest_link from wp_head.
  • Strips the X-Pingback response header on the front end.
  • Integrations can bypass via wpps_disable_xmlrpc_allow_request.
  • Enabling shows a confirmation because Jetpack, legacy mobile apps, and remote publishing can break.

When to use it

Section titled “When to use it”

Enable it if:

  • You do not use Jetpack XML-RPC features, classic WordPress mobile apps, or remote publishing tools.
  • You see brute-force or multicall noise against xmlrpc.php.
  • You already use the REST API (or nothing remote) for integrations.

When not to use it

Section titled “When not to use it”

How to enable it

Section titled “How to enable it”
  1. Go to WP PowerSuite -> Modules.
  2. Open Security or search for “Disable XML-RPC”.
  3. Toggle Disable XML-RPC on and confirm the warning if prompted.

How to test it

Section titled “How to test it”
  • Enable the module, then POST or GET /xmlrpc.php.
  • ✅ Pass: HTTP 403 and XML message that XML-RPC services are disabled.
  • View page source and response headers on the front end.
  • ✅ Pass: no RSD/WLW discovery links; no X-Pingback header.
  • ❌ Fail: confirm the module is on and a reverse proxy is not caching an old 200 response.

Troubleshooting

Section titled “Troubleshooting”
  • Jetpack or mobile app broke. Turn the module off, or allow specific traffic with wpps_disable_xmlrpc_allow_request.
  • Host-level XML-RPC block also exists. Fine; redundant blocking is OK.
  • Pingbacks only. Prefer Disable Trackbacks/Pingbacks if you still need other XML-RPC methods.

FAQ

Section titled “FAQ”
What does Disable XML-RPC do?

It blocks xmlrpc.php, disables XML-RPC methods, and removes discovery links and the X-Pingback header.

Is Disable XML-RPC free?

Yes. Enable it under WP PowerSuite -> Modules.

Will it break Jetpack?

It can. Jetpack and some legacy remote tools need XML-RPC - leave the module off or use the allow filter for trusted integrations.

Does Disable XML-RPC need configuration?

No. It is a simple on/off toggle.

How do I turn Disable XML-RPC off?

Go to WP PowerSuite -> Modules, find Disable XML-RPC, and toggle it off.

Developer notes (hooks & filters)

Source: modules/disable-xmlrpc/module.php. Boot: critical · context: frontend.

Hooks: xmlrpc_enabled, xmlrpc_methods, wp_headers; removes rsd_link / wlwmanifest_link. Bypass filter: wpps_disable_xmlrpc_allow_request.

Section titled “Related modules”