15 plugins compared · Updated August 2026 · Xml-rpc
Choosing a WordPress plugin for xml-rpc comes down to a few things: whether it is still actively maintained, whether real users rate it well, and whether it does the specific job you need without dragging the rest of the site down.
We ranked 15 plugins using our WPScore, which weighs the user rating (adjusted for how many people actually rated it), how many sites run it, how recently it was updated, and which WordPress version it is tested against. 15 of them have enough public data to be scored; the rest are listed below the ranked block, clearly marked, rather than being given a number we cannot justify.
How this list is funded. Some links here earn us a commission if you buy. It costs you nothing extra, and it does not move anything up the list — the order comes from the WPScore, which is calculated from public ratings, install counts and update history. See the method.
At a glance
Disables the XML-RPC API in WordPress 3.5+, which is enabled by default.
WPScore
Blocks dangerous XML-RPC methods while preserving Jetpack, WooCommerce, and mobile apps compatibility.
WPScore
Remove all WordPress methods from the XML-RPC API to increase security.
WPScore
A simple and lightweight plugin to disable XML-RPC API, X-Pingback and pingback-ping in WordPress 3.5+ for a faster and more secure website
WPScore
Enhance the Security and User Experience of Your Site with Login/Signup Security, Two-Factor Email Authentication, Social Logins and more...
WPScore
Stops abuse of your site's XML-RPC by simply removing some methods used by attackers. While you can use the rest of XML-RPC methods.
WPScore
Simply disable XML-RPC on your WordPress site with a simple toggle switch. Protect your site from XML-RPC attacks and improve security.
WPScore
Disables the XMP-RPC API service introduced in WordPress 3.5 and above.
WPScore
Enable/Disable XML-RPC for all or based on IP list, also you can control pingback and Unset X-Pingback from HTTP headers.
WPScore
TrimPress optimizes and trims some of the cruft from WordPress for a lighter, more secure theme!
WPScore
Avatar Manager for WordPress is a sweet and simple plugin for storing avatars locally and more. Easily.
WPScore
Prevent pingback, XML-RPC and denial of service DDOS attacks by disabling the XML-RPC pingback functionality.
WPScore
Work around for some versions of libxml2 2.7.x that strip out brackets when parsing XML. This plugin fixes XML-RPC requests that are mangled because …
WPScore
REST XML-RPC Data Checker allow to check JSON REST and XML-RPC API requests and grant access permissions.
WPScore
Control remote publishing with XML-RPC from the writing settings page.
WPScore