XML-RPC & REST Disabler
Disable WordPress XML-RPC and REST API through core hooks. Zero configuration — activate and harden your site.
Overview
SPP XML-RPC & REST Disabler is a specialized security utility designed to harden WordPress websites against remote exploits, unauthorized data harvesting, and denial-of-service attempts. By default, WordPress leaves its legacy XML-RPC endpoint and modern REST API routes fully exposed to the public web to facilitate remote connections and external integrations. However, these exposed gateways are frequently targeted by malicious bots for brute-force attacks and automated user enumeration, which can consume critical server resources and lead to security breaches. This plugin addresses these vulnerabilities by acting as a fast, low-level interceptor inside the WordPress boot process. By blocking or restricting these protocols early in the execution cycle, the utility dramatically reduces your site's attack surface without requiring complex server configuration changes or manual file editing