Disable XML-RPC
Switches off every XML-RPC method that needs a login and removes the X-Pingback header, closing an interface that lets attackers try many passwords in a single request.
What it does
Turns off a door most sites never use
Disable XML-RPC is a Vectro security feature that switches off every XML-RPC method that requires a username and password and removes the X-Pingback header, closing an interface attackers use to attempt many passwords in a single request.
XML-RPC is a remote interface that predates the REST API. It lets external software publish posts, fetch content and manage a site without using wp-admin. It is still enabled on every WordPress install by default, whether or not anything uses it.
This feature switches off the XML-RPC methods that require a login, so any call that carries a username and password is refused before the credentials are checked. It also removes the X-Pingback header that advertises the endpoint to anything scanning your responses.
Before you enable it, check what connects to your site. Jetpack uses XML-RPC, as do some older mobile publishing apps and a handful of remote management tools. If you rely on any of those, leave this off.
Why it matters
One request, hundreds of password guesses
The reason XML-RPC matters for security is amplification. Its system.multicall method lets a single HTTP request carry many authentication attempts at once. A login limiter that counts requests sees one request; the attacker gets hundreds of guesses out of it. That is a meaningfully different problem from ordinary brute force against a login form.
How to use it
Confirm nothing needs it, then switch it off
Technical detail
What is switched off
Vectro sets the WordPress xmlrpc_enabled filter to false, which makes the XML-RPC server refuse every method that requires authentication before any credentials are checked. It also removes the X-Pingback header that WordPress adds to responses.
This is a server-side block. It does not depend on rewrite rules or on editing .htaccess, so it behaves the same on Apache, Nginx and LiteSpeed.
X-PingbackCompatibility
Runs alongside everything
No conflicts detected. Vectro runs this feature regardless of other plugins active.
Questions
Frequently asked
What does disabling XML-RPC in WordPress do?
Disabling XML-RPC in Vectro switches off every XML-RPC method that requires a login and removes the X-Pingback header from your responses. Password guesses sent through xmlrpc.php, including hundreds packed into one system.multicall request, are refused before any credentials are checked.
Does disabling XML-RPC break Jetpack?
Yes – Jetpack uses XML-RPC to communicate with your site, so disabling it will break that connection. Older WordPress mobile app publishing and some remote management tools rely on XML-RPC as well, so check what connects to your site first.
How do I disable XML-RPC in Vectro?
Go to Vectro > Security in wp-admin and toggle Disable XML-RPC on. Confirm nothing on your site depends on XML-RPC first, then verify that the X-Pingback header no longer appears in your homepage response headers.
Is disabling XML-RPC in Vectro free or Pro?
Yes, Disabling XML-RPC is free. It is included in the free Vectro plugin on WordPress.org with no account required.
What happens if I deactivate Vectro with XML-RPC disabled?
XML-RPC returns to its normal WordPress behaviour immediately, because Vectro blocks it in PHP rather than through rewrite rules or .htaccess edits. No server configuration is left behind to clean up.
Related features
Close the other default openings
Vectro Pro adds a malware scanner that checks core, theme and plugin files for known threats. See Pro plans
Download Vectro free on WordPress.org
27 features across Security, Performance and Maintenance. No account required, no expiry, unlimited sites.