15 plugins compared · Updated August 2026 · Xmlrpc
Choosing a WordPress plugin for xmlrpc comes down to a few things: whether it is still actively maintained, whether real users rate it well, and whether it does the specific job you need without dragging the rest of the site down.
We ranked 15 plugins using our WPScore, which weighs the user rating (adjusted for how many people actually rated it), how many sites run it, how recently it was updated, and which WordPress version it is tested against. 15 of them have enough public data to be scored; the rest are listed below the ranked block, clearly marked, rather than being given a number we cannot justify.
How this list is funded. Some links here earn us a commission if you buy. It costs you nothing extra, and it does not move anything up the list — the order comes from the WPScore, which is calculated from public ratings, install counts and update history. See the method.
At a glance
Disables the XML-RPC API in WordPress 3.5+, which is enabled by default.
WPScore
Blocks dangerous XML-RPC methods while preserving Jetpack, WooCommerce, and mobile apps compatibility.
WPScore
Remove all WordPress methods from the XML-RPC API to increase security.
WPScore
A simple and lightweight plugin to disable XML-RPC API, X-Pingback and pingback-ping in WordPress 3.5+ for a faster and more secure website
WPScore
Login Delay Shield slows down brute-force attacks by adding a configurable delay to failed login attempts while keeping successful logins instant.
WPScore
Simply disable XML-RPC on your WordPress site with a simple toggle switch. Protect your site from XML-RPC attacks and improve security.
WPScore
Disables the XMP-RPC API service introduced in WordPress 3.5 and above.
WPScore
Adds a secret URL key to access the login page and lets you disable XML-RPC, protecting against bruteforce attacks.
WPScore
Several opinionated WordPress tweaks focused in security and performance.
WPScore
Prevent pingback, XML-RPC and denial of service DDOS attacks by disabling the XML-RPC pingback functionality.
WPScore
REST XML-RPC Data Checker allow to check JSON REST and XML-RPC API requests and grant access permissions.
WPScore
This plugin disables the WordPress XMLRPC pingback ping.
WPScore
Make XML-RPC work if you rename the file. Some hosts block access to xmlrpc.php file making it impossible to use
WPScore
Control remote publishing with XML-RPC from the writing settings page.
WPScore
Simple plugin that disables XML-RPC.
WPScore