# Disable XML-RPC Multicall

> Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, xml-rpc, brute-force
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/disable-xmlrpc-multicall/

## Code

```php
add_filter( 'xmlrpc_methods', function ( $methods ) {
    unset( $methods['system.multicall'] );

    return $methods;
} );
```

## Notes

Use the "Disable XML-RPC" snippet instead if nothing on your site needs XML-RPC.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Disable XML-RPC Multicall" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/