Founding offer 50% off all plans for the first 100 customers, and your renewal price is locked for life. 74 spots left Claim your spot
Turquoise abstract wavy W logo on a black background
Turquoise abstract wavy W logo on a black background
White WP PowerSuite logo on a black background
White WP PowerSuite logo on a black background

Summarize with AI:

On This Page
Last updated: 24/07/2026

Disable XML-RPC

Closes the old XML-RPC channel many password-guessing tools still target. Fine for most sites; skip if you rely on legacy apps or remote publishing that need it.

Overview

Closes XML-RPC: blocks xmlrpc.php, empties methods, and removes RSD/WLW links and X-Pingback. Fine for most modern sites. Skip if you rely on Jetpack, legacy mobile apps, or remote publishing that needs XML-RPC—the enable confirm warns about that. Soft overlap with Disable Trackbacks/Pingbacks (ping subset) and Limit Login Attempts (still covers XML-RPC if left open).

Solid black square
Solid black square
Who is this for?

  • Most modern sites as a free baseline
  • Teams reducing password-guessing surface
  • Not Jetpack-dependent or legacy remote-publishing installs

Features

Block xmlrpc.php
Close the classic XML-RPC endpoint.
Empty methods
Remove available XML-RPC method surface.
Discovery cleanup
Remove RSD/WLW links and X-Pingback where applicable.
Enable confirmation
Warns about Jetpack / mobile / remote publishing impact.
Zero ongoing settings
Enable when you do not need the channel.

Use Cases

  • Brute-force surface reduction
    Close XML-RPC on brochure and content sites.
  • Agency hardening pack
    Default-on for clients not using Jetpack.
  • Pair with Limit Login Attempts
    If you must keep XML-RPC, rate-limit failures instead.

Frequently Asked Questions

Related Modules

Disable Password Reset

Turn off public "forgot password" self-service for everyone. Use only when you reset passwords another way (manual admin password, WP-CLI, or admin-sent...
Security
Disabled

IP Allow & Block List Pro

Allow or block visitors by IP address—ideal for office-only dashboards or shutting out known troublemakers. Rules apply site-wide, including wp-admin and login.
Security
Disabled

Disable File Editing

Remove the dashboard screens that let anyone edit theme or plugin code from the browser—one less disaster if an account is compromised.
Security
Disabled

Password Protection

Put your whole site behind one shared password—ideal for staging, client previews, or a soft launch before you go public.
Security
Disabled

Activity Log

Keep a clear record of important dashboard activity—who logged in, what changed, and when—so you can investigate issues or stay audit-ready without...
Security
Disabled

Cloudflare Turnstile

Bot protection with Cloudflare Turnstile on logins, forms, comments, and WooCommerce—low hassle for real people.
Security
Disabled

Block Usernames

Blocks risky default usernames during registration so bots have fewer easy targets.
Security
Disabled

Force SSL Admin

Always open your dashboard and login screen over a secure https:// link. Anyone using the old http:// address is sent to the...
Security
Disabled

Email Obfuscator

Automatically protects visible email addresses and mailto links from basic spam bots by safely encoding them while keeping them clickable for visitors.
Security
Disabled

Two-Factor Authentication (2FA)

Two-factor login for selected roles—extra proof beyond the password.
Security
Disabled
Founding Member Offer 74 of 100 spots left

Before you go, here's what you'd be leaving.

WP PowerSuite launched this month. The first 100 customers get 50% off and keep that renewal price permanently. When the offer closes on 31 August 2026, prices return to $79 / $239 / $399 and stay there.

  • 154 modules, all included on every plan
  • Renewal price locked for life
  • 14-day refund, one email, no questions
See founding pricing
26 founding members so far 22 days left