Disables the XML-RPC API in WordPress 3.5+, which is enabled by default.
As of April 2026, Disable XML-RPC is a WordPress xmlrpc plugin with 200K+ active installations and a 4.3/5 rating from 29 reviews. It has been downloaded 611K+ times in total. Requires WordPress 3.5+ and PHP false+. Available on WordPress.org since 2012. Downloads are down 10% this week. Top alternative: Disable XML-RPC-API.
Pretty simply, this plugin uses the built-in WordPress filter “xmlrpc_enabled” to disable the XML-RPC API on a WordPress site running 3.5 or above.
Beginning in 3.5, XML-RPC is enabled by default. Additionally, the option to disable/enable XML-RPC was removed. For various reasons, site owners may wish to disable this functionality. This plugin provides an easy way to do so.
Dead simple as it should be. Nice, thank you for that.
It works perfectly on WordPress 6.4.3 (tested in 2 sites), without plugins conflict. See the tab FAQ to check that after instal, just test it on website quoted there: (xmlrpc-check) – if the test returns Fail on check xmlrpc the plugin worked. You can also run that test BEFORE instal the plugin to prove its work.
Does not work with WordPress 6.4.2, xmlrpc-check tool still shows “All XML-RPC methods are available on the server”
Works perfect and is easy to use
No adware
| WordPress | 3.5+ requiredTested up to 6.9.4 |
| PHP | false+ required |
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.