# Disable XML-RPC

> Turns off the XML-RPC interface (xmlrpc.php), a common target for brute-force and pingback abuse. Use it when no app or service needs XML-RPC.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, xml-rpc, pingback
- Author: WPIDE Team
- Installs: 6
- Updated: 2026-10-28
- Page: https://wpide.com/library/disable-xmlrpc/

## Code

```php
add_filter( 'xmlrpc_enabled', '__return_false' );

add_filter( 'xmlrpc_methods', function () {
    return array();
}, 999 );

add_filter( 'wp_headers', function ( $headers ) {
    unset( $headers['X-Pingback'] );

    return $headers;
} );

remove_action( 'wp_head', 'rsd_link' );
```

## Notes

The WordPress mobile apps and some services (for example Jetpack) rely on XML-RPC.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Disable XML-RPC" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/