wee/wee-remove-xmlrpc-methods

WordPress plugin to remove all XML-RPC methods from the API.

1.4.1 2024-10-06 09:57 UTC

Requires

• php: ^5.4 || ^7.0 || ^8.0

Requires (Dev)

• php: ^8.2
• composer/installers: ~2.3
• dealerdirect/phpcodesniffer-composer-installer: ^1.0.0
• phpcompatibility/php-compatibility: ^9.3.5
• squizlabs/php_codesniffer: ^3.10.3
• wp-coding-standards/wpcs: ^3.1.0

GPL-2.0-or-later

• Walter Ebert

README

WordPress plugin to remove all WordPress XML-RPC methods from the API to increase security.

This plugin does more than just using the xmlrpc_enabled hook, because that is only used “To disable XML-RPC methods that require authentication”.

Activating this plugin will also disable pingbacks, trackbacks, and Really Simple Discovery (RSD), because these rely on XML-RPC.

It works with any webserver, because it does not use the .htaccess file.

Testing the plugin

From the command line you can test if the plugin is working correctly using cURL. Replace the example.com link to match your website:

curl -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params><param><value><string/></value></param></params></methodCall>' https://example.com/xmlrpc.php

This should only return the following methods:

• system.multicall
• system.listMethods
• system.getCapabilities

Author

Walter Ebert

License

GPL-2.0-or-later