Disable XML-RPC

XML-RPC is WordPress’s legacy remote publishing API. Most sites don’t use it, but attackers do — it’s a common vector for brute-force attacks because the system.multicall method allows hundreds of login attempts in a single HTTP request, bypassing most rate limiters.

disable-xmlrpc.php

<?php
/**
 * Disable XML-RPC
 *
 * XML-RPC is a legacy remote publishing protocol that most sites no longer
 * need. It's a common target for brute-force attacks and DDoS amplification
 * because it allows multiple login attempts in a single request via
 * system.multicall. Disabling it closes this attack surface entirely.
 * Note: Jetpack requires XML-RPC — skip this if you use Jetpack.
 *
 * Usage: Add to functions.php.
 *
 * @category security
 * @language php

 *
 * @author Adame Dahmani https://adame.io
 * @support Support my family project: https://adame.io/fundraiser
 */
add_filter( 'xmlrpc_enabled', '__return_false' );

add_filter( 'wp_headers', function ( $headers ) {
    unset( $headers['X-Pingback'] );
    return $headers;
} );

add_filter( 'xmlrpc_methods', function () {
    return [];
} );

This disables the XML-RPC handler, removes the X-Pingback header, and empties the methods list. Note: Jetpack requires XML-RPC to communicate with WordPress.com — skip this snippet if you use Jetpack.