/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Disable XML-RPC-API

Disable XML-RPC-API

By Amin Nazemi

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Disable XML-RPC-API Review - In-Depth Analysis

Disable XML-RPC API to enhance website security and performance. Prevent brute-force and DDoS attacks by disabling unnecessary features.

Performance Overview

WPS Score

6.8/10

User Rating

4.2/5 (based on 43+ reviews)

Active Installations

100,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin helps protect your website from xmlrpc brute-force attacks, DDoS, and DoS attacks by disabling the XML-RPC and trackbacks-pingbacks on your WordPress site.

It offers features such as disabling access to the xmlrpc.php file, changing htaccess file permissions, minimizing CPU usage by disabling X-pingback, and removing pingback-ping links from the header. You can also blacklist or whitelist IPs for XML-RPC access.

Additionally, this plugin allows you to disable the JSON REST API, hide the WordPress version, and disable the built-in WordPress file editor. These options contribute to a faster and more secure WordPress experience.

Comparing to Alternatives

Disable XML-RPC-API is one of several plugins designed to disable or manage XML-RPC functionality in WordPress, helping to reduce security risks and server load.

Top alternatives

Strengths

Effectively disables XML-RPC as intended
Simple and straightforward to use
No known security vulnerabilities reported
Highly rated by majority of users
Lightweight plugin with minimal impact

Weaknesses

Reports of spammy admin notices promoting other plugins
Some users experienced site crashes and server errors
Allegations of malicious backdoor code injection
Limited support or updates indicated

User Sentiment Analysis

With a 4.2 average rating from 43 reviews, most users find the plugin effective, though about 21% of ratings are low, reflecting serious concerns.

Positive highlights

'It work perfectly' - mehditabbakh
'does what it should' - bugscout
'Good Job' - mehditabbakh
'Could you please add capability to exclude specific domain names' - ajaxy12

Common complaints

Spammy admin notices promoting other plugins
Site crashes with 500 server errors after installation
Alleged injection of malicious backdoor PHP scripts
Modification of PHP files causing security concerns

Weaknesses

Potentially intrusive admin notices
Stability issues causing site crashes
Serious security allegations despite no official vulnerabilities
Limited transparency on plugin safety

Who Should Use This?

Best for

Users seeking a simple and effective way to disable XML-RPC functionality without complex configuration.

Not ideal for

Those who prioritize security and stability highly, given reports of site crashes and alleged malicious behavior; users should consider alternatives or thoroughly test before use.

Pricing & Value

Free version includes

The free version offers core functionality to disable XML-RPC API without additional features.

Final Verdict

Disable XML-RPC-API is a straightforward plugin that effectively disables XML-RPC functionality, earning positive feedback from most users for its simplicity and performance. However, serious concerns have been raised by some users regarding site stability and potential security risks, including allegations of malicious code injection, which are not officially confirmed but warrant caution.

Given the availability of several alternative plugins with similar functionality and potentially better reputations, users should carefully weigh the risks and benefits. Those needing a reliable and secure solution may want to explore other options or ensure thorough testing before deploying this plugin on critical sites.