PluginScout

Disable XML-RPC-API

by Amin Nazemi · WordPress.org page · Website

v2.1.7 Tested up to WP 6.9.7

Disable XML-RPC-API has 100,000+ active installs on WordPress.org and 824,358 downloads all time. We have tracked it since September 4, 2026; download trends appear after 30 days of data. The last update was on February 4, 2026, tested up to WordPress 6.9.7.

Disable XML-RPC-API at a glance

Active installs
100,000+
Total downloads
824,358
Downloads, last 30 days
–
available after 30 days of tracking
30-day growth
–
tracking since September 4, 2026

Is Disable XML-RPC-API well maintained?

Support threads resolved
0 of 1
recent threads on the WordPress.org support forum
WordPress compatibility
Behind
tested up to WordPress 6.9.7, not yet with the current 7.1
One-star reviews
16%
7 of 43 reviews on WordPress.org

Features

The feature list from the plugin's own readme on WordPress.org, trimmed to the essentials.

  • Disable access to xmlrpc.php file using .httacess file
  • Automatically change htaccess file permission to read-only (0444)
  • Disable X-pingback to minimize CPU usage
  • Disable selected methods from XML-RPC
  • Remove pingback-ping link from header
  • Disable trackbacks and pingbacks to avoid spammers and hackers
  • Rename XML-RPC slug to whatever you want
  • Black list IPs for XML-RPC
  • White list IPs for XML-RPC
  • Some options to speed-up your wordpress website
  • Disable JSON REST API
  • Hide WordPress Version

Disable XML-RPC-API reviews and ratings

43 reviews on WordPress.org, with the most recent ones as their authors posted them.

All reviews
4.2 out of 5

43 reviews

5★
33
4★
0
3★
1
2★
2
1★
7

  • Good Job

    It work perfectly

    mehditabbakh

  • does what it should

    i tried 3 plugins, this does what it should :-)

    bugscout

  • Harmful

    Website crashed error 500 server. All php files was modified. But i'm not sure who dumb person downloaded at my company website. 4 days to settled all the issues.

    firafiki

  • Error

    My whole site crashed . 500 server error. (.htacces failure) Unistalled, found another solution.

    elmo2000

  • Hotlinking

    Could you please add capability to exclude spesific domain names from Disable Hotlinking and Leaching of Your Content section? We want to show some of our content on other webiste via iframe

    ajaxy12

  • DO NOT INSTALL THIS! **PHP BACKDOOR**

    WARNING! This extension will sneakily inject obfuscated yanz backdoor PHP scripts in your document root and will hijack your Wordpress site. THREE of my customers websites were hacked this week and the ONLY extension that they all have in common that recently got installed is Disable XML-RPC-API. They literally have nothing else in common and they don't know each other nor use the same theme nor even the same Wordpress release. BE WARNED.

    ben2358723823567

Disable XML-RPC-API alternatives

Plugins that solve the same problem, ranked by how closely they overlap with Disable XML-RPC-API.

All Disable XML-RPC-API alternatives

Details

A simple and lightweight plugin to disable XML-RPC API, X-Pingback and pingback-ping in WordPress 3.5+ for a faster and more secure website

The full description, screenshots and every review live on the WordPress.org page.

Tags

  • disable xml-rpc
  • disable xmlrpc
  • pingback
  • stop brute force attacks
  • xmlrpc

More from Amin Nazemi

Version
2.1.7
Last updated
Feb 4, 2026
First published
Oct 1, 2020
Requires WordPress
5.0
Tested up to
6.9.7
Requires PHP
–
Pricing
Free on WordPress.org

Disable XML-RPC-API FAQ

What does Disable XML-RPC-API do?

According to its WordPress.org readme, Disable XML-RPC-API offers Disable access to xmlrpc.php file using .httacess file, Automatically change htaccess file permission to read-only (0444), Disable X-pingback to minimize CPU usage, Disable selected methods from XML-RPC and Remove pingback-ping link from header.

How many active installs does Disable XML-RPC-API have?

WordPress.org reports 100,000+ active installs for Disable XML-RPC-API as of September 7, 2026.

Is Disable XML-RPC-API still maintained?

Yes. The last release was on February 4, 2026 and it is tested up to WordPress 6.9.7.

Does Disable XML-RPC-API have good support?

On the WordPress.org forum, 0 of 1 recent support threads for Disable XML-RPC-API are marked resolved. That is the developer's free support; a paid version usually comes with its own channel.

Is Disable XML-RPC-API free?

Disable XML-RPC-API is free to install from WordPress.org. Many plugins also sell a paid version or add-ons.