Disable XML-RPC
Disables the XML-RPC API in WordPress 3.5+, which is enabled by default.
The facts
- Rating
- 4.2★ from 33
- Active installs
- 200k+
- Price
- Free
- Last updated
- 27 May 2026
- Added
- Sep 2012
- Requires WP
- 3.5
- Tested up to
- WP 7.0.4
- Downloads
- 658,640
Our analysis
AI-assistedDisable XML-RPC is a WordPress plugin that allows you to disable the XML-RPC API on your site. It uses the built-in WordPress filter 'xmlrpc_enabled' to achieve this functionality. This is particularly useful for site owners who want to enhance their site's security by preventing XML-RPC access, which is enabled by default in WordPress versions 3.5 and above.
The plugin is suitable for WordPress sites running version 3.5 or higher. It provides a straightforward solution for those who prefer to disable XML-RPC for various reasons, such as reducing potential attack vectors.
Best for: WordPress site owners looking to enhance security by disabling XML-RPC.
What it does well
- ✓Disables XML-RPC API easily
- ✓Uses built-in WordPress filter
- ✓Suitable for WordPress 3.5 and above
- ✓Free to use from WordPress.org
- ✓Active installation count of 200,000
Where it falls short
- •Limited feature information provided
- •No options for configuring XML-RPC functionality
Verdict
Disable XML-RPC offers a simple solution for those wanting to turn off XML-RPC functionality. It is a straightforward tool for improving site security.
From the developer
Phil Erb's own description of Disable XML-RPC, lightly tidied.
Pretty simply, this plugin uses the built-in WordPress filter “xmlrpc_enabled” to disable the XML-RPC API on a WordPress site running 3.5 or above.
Beginning in 3.5, XML-RPC is enabled by default. Additionally, the option to disable/enable XML-RPC was removed. For various reasons, site owners may wish to disable this functionality. This plugin provides an easy way to do so.