/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Disable XML-RPC

Disable XML-RPC

By Phil Erb

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Disable XML-RPC Review - In-Depth Analysis

Disables the XML-RPC API in WordPress 3.5+, which is enabled by default.

Performance Overview

WPS Score

6.96/10

User Rating

4.1/5 (based on 34+ reviews)

Active Installations

200,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin uses the built-in WordPress filter 'xmlrpc_enabled' to disable the XML-RPC API on a WordPress site running 3.5 or above.

Beginning in 3.5, XML-RPC is enabled by default. Additionally, the option to disable/enable XML-RPC was removed. For various reasons, site owners may wish to disable this functionality. This plugin provides an easy way to do so.

Comparing to Alternatives

Disable XML-RPC is a focused plugin designed to block XML-RPC functionality in WordPress, with several alternatives offering similar features but varying in complexity and additional options.

Top alternatives

Strengths

Very simple and straightforward to use.
Effectively blocks XML-RPC methods as confirmed by user tests.
No adware or unwanted software included.
Maintains compatibility with recent WordPress versions for many users.
Low security risk with no known vulnerabilities.

Weaknesses

Reported issues with compatibility on some WordPress versions.
Does not work properly on WordPress Multisite installations.
Lacks advanced configuration options found in some alternatives.
Some users report it stops working after updates.

User Sentiment Analysis

With a strong majority of 5-star ratings and a few low ratings, users generally appreciate the plugin's simplicity and effectiveness, though some report compatibility issues.

Positive highlights

"Just as simple as it should be. Very good." - terps001
"Works perfect and is easy to use." - charmingdoggo
"No adware." - tomhung
"Perfect plugin on updated WP version." - zaririnatma
"Dead simple as it should be. Nice, thank you for that." - art-at-tec

Common complaints

Plugin stopped working for some users.
Does not function on WordPress Multisite.
Fails to work on certain WordPress versions like 5.8.3 and 6.4.2.
XML-RPC methods remain accessible despite plugin activation.

Weaknesses

Limited support for multisite environments.
Inconsistent performance across WordPress versions.
No advanced features or customization options.
Some users experience plugin failure after updates.

Who Should Use This?

Best for

Users seeking a lightweight, no-frills solution to disable XML-RPC on single WordPress sites who prioritize simplicity and security.

Not ideal for

Those running WordPress Multisite installations or requiring advanced XML-RPC management features; also users on certain WordPress versions that have reported compatibility issues.

Pricing & Value

Free version includes

The free version offers complete disabling of XML-RPC functionality with no ads or additional bloat, providing essential protection against XML-RPC based attacks.

Final Verdict

Disable XML-RPC is a straightforward and effective plugin for blocking XML-RPC requests, favored for its simplicity and lack of bloat. It enjoys strong positive feedback from users who value its ease of use and security benefits.

However, it faces challenges with compatibility on some WordPress versions and multisite setups, which limits its suitability for all users. Alternatives may offer more features or better multisite support, but this plugin remains a solid choice for basic XML-RPC disabling needs.