Simple Disable XML-RPC is a lightweight, battle-tested, and developer-friendly WordPress security plugin that provides comprehensive protection against XML-RPC vulnerabilities. Protect your WordPress site from brute force attacks, DDoS attempts, and resource exhaustion with a single click. 🔒 Why Di
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.1 and PHP 7.4.
SourceWordPress plugins · Nov 14, 2026
01 / Source details
Aboutthistool.
Simple Disable XML-RPC is a lightweight, battle-tested, and developer-friendly WordPress security plugin that provides comprehensive protection against XML-RPC vulnerabilities. Protect your WordPress site from brute force attacks, DDoS attempts, and resource exhaustion with a single click.
🔒 Why Disable XML-RPC?
XML-RPC is an obsolete remote communication protocol originally built for external desktop blogging applications. While historically useful, modern WordPress relies on the secure REST API. Today, XML-RPC is one of the most frequently exploited vectors for:
Brute Force Attacks – Hackers execute system.multicall to attempt thousands of username and password combinations in a single HTTP request, completely bypassing basic login rate limiters.
DDoS Amplification Attacks – Attackers abuse the pingback.ping method to turn thousands of vulnerable WordPress websites into botnet reflectors against targeted hosts.
Server Resource Exhaustion – Continuous scans and exploit probes against /xmlrpc.php consume CPU cycles, MySQL connections, and memory.
✨ Key Features in Version 1.4.1
🎯 One-Click Master Switch – Instantly enable or disable XML-RPC via an accessible, modern toggle.
🛡️ Direct Request Blocker (HTTP 403) – Immediately terminates direct hits to xmlrpc.php with an HTTP 403 Forbidden status before full WordPress initialization, saving precious server resources.
🧹 Header Footprint Cleanup – Automatically removes the Really Simple Discovery (RSD / EditURI ) and Windows Live Writer ( wlwmanifest ) links from your website’s <head> .
🚫 X-Pingback Stripper – Safely removes the X-Pingback HTTP header from all server responses.
🧪 Live Diagnostics & Self-Test Tool – Test your live xmlrpc.php endpoint directly from the admin dashboard to verify that your site is protected.
⭐ Recommended Plugins Hub – A dedicated menu showcasing all plugins by community contributor Delower Hossain (@wpdelower) with one-click AJAX install, activate, and deactivate.
🎨 Ultra-Professional Admin Interface – Modern card design, real-time status banners, live search filters, and smooth responsive layout.
🌐 Translation Ready – Fully internationalized and compatible with multilingual setups.
🧹 Complete Clean Uninstall – Cleans up all database options and transients on both single-site and multisite networks.
🆕 What’s New in Version 1.4.1
🚀 Recommended Plugins Section: Brand new submenu and tab featuring all WordPress plugins by Delower Hossain (@wpdelower) with instant AJAX installation, activation, and deactivation.
🔒 HTTP 403 Direct Request Blocker: Halts requests to xmlrpc.php early to avoid CPU spikes during DDoS and brute force scans.
🧹 DOM & Header Cleanup: Strips rsd_link and wlwmanifest_link from <head> .
🧪 Live XML-RPC Diagnostic Tester: Built-in connection tester to verify endpoint status.
🎨 Elevated UI: Enterprise-grade header, protection badges, real-time status banner, and quick filter controls.
⚡ Modular Architecture: Clean separation into SDXRPC_Core , SDXRPC_Admin , and SDXRPC_Recommended .
🎯 Perfect For
Security-conscious WordPress website owners.
Websites experiencing XML-RPC brute force or high server load.
Administrators who do not use the WordPress mobile app or legacy publishing tools.
Agencies and developers managing client sites needing zero-overhead protection.
⚠️ Important Note
Disabling XML-RPC may affect: * WordPress mobile apps * Jetpack (features requiring XML-RPC) * Remote XML-RPC publishing clients * Trackbacks and pingbacks
If you do not utilize these services, disabling XML-RPC is strongly recommended.
🤝 Contributing & Bug Reports
Bug reports and pull requests are welcome on GitHub .
💝 Support the Development
If you find this plugin helpful: * ⭐ Rate it 5 stars on WordPress.org * 💬 Check out our other plugins
Privacy Policy
Simple Disable XML-RPC does not: * Collect or store personal user data * Track user activity or use tracking cookies * Send personal data to third parties
The plugin only queries the official WordPress.org Plugins API when an administrator visits the Recommended Plugins page to display plugin updates and metrics.
Credits
Developed with ❤️ by Delower Hossain & MonarchWP
Contributors: * wpdelower * monarchwp23
Special thanks to all our users and contributors!
See it in action
Screenshots & previews.
Settings & Hardening Dashboard - Modern protection overview, master toggle, advanced hardening options, and live XML-RPC diagnostics.Recommended Plugins Hub - Browse, install, activate, and deactivate plugins by Delower Hossain (@wpdelower).
02 / Source details
Gettingstarted.
Automatic Installation (Recommended)
01Log in to your WordPress admin panel.
02Navigate to Plugins > Add New .
03Search for “Simple Disable XML-RPC” .
04Click “Install Now” and then “Activate” .
05Go to Disable XML-RPC > Settings to verify your protection settings.
Manual Installation
06Download the plugin ZIP file.
07In your WordPress admin, go to Plugins > Add New > Upload Plugin .
08Choose the ZIP file and click “Install Now” .
09Click “Activate Plugin” .
10Configure your settings under Disable XML-RPC .
03 / Source details
Frequently asked questions.
What is XML-RPC and why should I disable it?
XML-RPC is an older remote communication API. Modern WordPress applications use the REST API. Attackers frequently exploit XML-RPC for password brute forcing (via system.multicall ) and DDoS amplification (via pingback reflection). Disabling it closes these attack surfaces.
Does this plugin block requests early to save server resources?
Yes! In version 1.4.1, the Direct Request Blocker sends an HTTP 403 Forbidden header immediately when xmlrpc.php is requested, terminating execution before WordPress processes expensive queries or XML payloads.
How does the Recommended Plugins section work?
Under Disable XML-RPC > Recommended Plugins , you can view all WordPress plugins created by Delower Hossain (@wpdelower). You can install, activate, and deactivate any recommended plugin with a single click using AJAX without leaving the page.
How can I verify that XML-RPC is disabled?
Go to Disable XML-RPC > Settings and click the “Test XML-RPC Endpoint” button under the Live Diagnostics section. It will send a test request and report whether the endpoint returns HTTP 403 Forbidden or a disabled fault.
Will this plugin break my website?
No. The plugin uses WordPress filters and standard status headers. Only services that explicitly require XML-RPC (such as the WordPress mobile app or certain Jetpack modules) are affected.
Does this plugin work on WordPress Multisite?
Yes, it functions on both single-site and WordPress Multisite networks. The uninstall script cleanly cleans up network-wide settings.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
