=== SPP XML-RPC & REST Disabler ===
Contributors: simpliplugin
Tags: security, xmlrpc, rest api, disable, hardening
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Disable WordPress XML-RPC and REST API through core hooks. Zero configuration — activate and harden your site.

== Description ==

**SPP XML-RPC & REST Disabler** acts as a specialized interceptor inside the WordPress boot process. Instead of editing core WordPress files, it plugs directly into specific action and filter hooks to alter WordPress's default behaviors before a request finishes executing.

Part of the [SimpliPlugin](https://simpliplugin.com/) security plugin family.

= What it disables =

* XML-RPC requests to `xmlrpc.php`
* REST API access for all visitors by default
* XML-RPC and REST discovery links in HTML headers
* The `X-Pingback` response header

= How it works =

1. On plugin load, interceptors register on WordPress hooks during bootstrap.
2. XML-RPC is blocked through the `xmlrpc_enabled` filter and an early `init` guard.
3. REST API access is rejected through the `rest_authentication_errors` filter before routes are dispatched.
4. Public discovery links for both APIs are removed from page output.

= Settings screen =

Go to **Settings → XML-RPC & REST Disabler** to control XML-RPC blocking, REST API blocking, and whether logged-in users may still access REST.

= Zero configuration =

On activation, secure defaults are applied automatically. You can adjust behavior from the settings screen without writing code.

= Developer filters =

* `simpliplugin_xmlrpcrestdisabler_disable_xmlrpc` — control XML-RPC blocking (default: `true`)
* `simpliplugin_xmlrpcrestdisabler_disable_rest` — control REST API blocking (default: `true`)
* `simpliplugin_xmlrpcrestdisabler_allow_authenticated_rest` — allow logged-in users to access REST (default: `false`)

= Links =

* [Plugin homepage on WordPress.org](https://wordpress.org/plugins/spp-xmlrpc-rest-disabler/)
* [Developer website](https://simpliplugin.com/)

== Installation ==

1. Upload the `spp-xmlrpc-rest-disabler` folder to `/wp-content/plugins/`, or install via the WordPress plugin installer.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Go to **Settings → XML-RPC & REST Disabler** to review or change the defaults.

== Frequently Asked Questions ==

= Will this break the block editor or admin features? =

Disabling the REST API can affect tools that rely on it, including the block editor, some plugins, and mobile apps. If you need REST for logged-in administrators, use the `simpliplugin_xmlrpcrestdisabler_allow_authenticated_rest` filter in a small custom plugin or your theme's `functions.php`.

= Will Jetpack still work? =

Jetpack and some legacy integrations depend on XML-RPC. Test your site after activation if you use those services.

= Do I need to configure anything? =

No. Secure defaults are enabled on activation. Use **Settings → XML-RPC & REST Disabler** if you want to change them.

= Does this plugin store any data? =

Yes. It stores your settings choices in the WordPress options table. No external requests are made.

== Screenshots ==

1. Settings page under Settings → XML-RPC & REST Disabler
2. Plugin active on the Plugins screen with a Settings action link

== Changelog ==

= 1.0.0 =
* Initial release.
* Block XML-RPC through core hooks and early request interception.
* Block REST API access through authentication filter.
* Remove XML-RPC and REST discovery links from public output.
* Developer filters for selective control.

== Upgrade Notice ==

= 1.0.0 =
Initial release of SPP XML-RPC & REST Disabler.
