Disable XML-RPC Multicall
Removes the XML-RPC system.multicall method, which attackers use to try hundreds of passwords in a single request, while XML-RPC keeps working for apps and Jetpack.
Opens WPIDE on
Code
add_filter( 'xmlrpc_methods', function ( $methods ) {
unset( $methods['system.multicall'] );
return $methods;
} );Notes
Use the "Disable XML-RPC" snippet instead if nothing on your site needs XML-RPC.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.