Additionally to using htaccess, you can disable the XML-RPC function by adding the following to your child theme’s functions.php:
# Set XML-RPC features to false
add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'pre_option_enable_xmlrpc', '__return_zero' );
Related Posts:
- Blocking access to wp-login via htaccess not working
- XMLRPC filtering through htaccess not working
- Basic Auth .htaccess on wp-login, but allow logout from woocommerce
- Improve wordpress security by hiding non public resources
- Does this .htaccess security setting really work?
- Change Login URL Without Plugin
- File and directory permissions
- adding rewrite rules in .htaccess
- Using “wordpress_logged_in” to restrict direct access to uploads folder in 2021
- WordPress URL/Folder ReWrite using Htaccess
- Which WordPress scripts need to be executable for a fresh installation?
- Block only external access to wp-cron.php on OpenLiteSpeed
- Restricting user login by IP address
- WordPress: Adding Security
- How do I test to ensure that my wp-config file is protected?
- WordPress not seeing .htaccess rules
- Rules in .htaccess only if the requested URL is /wp-admin
- Disable directory browsing of uploads folder
- Strange behaviour of is_user_logged_in() and get_current_user_id()
- Selectively Disabling PHP via .htaccess in Root Directory
- Azure WordPress deny access to xmlrpc
- Should I prevent access to .htaccess and wp-config.php files?
- Blocking wp-login in HTACCESS has also blocked password protected pages
- Using htaccess to prevent spam through wp-comments-post.php
- How can I create a private site that is inaccessible from the outside?
- Restrict Content for only Contributors via .htaccess
- Allowing access to certain WordPress created pages or posts with htaccess / htpasswd
- Security headers disappear on WordPress pages
- Why is this line of code Wrong in every WordPress .Htaccess security article?
- How to redirect all HTTP requests to HTTPS
- Best collection of code for your .htaccess file [closed]
- Best way to eliminate xmlrpc.php?
- Default .htaccess file for WordPress?
- Which one does WordPress prioritize when it comes to php.ini, wp-config and .htaccess?
- Security and .htaccess
- WordPress site hacked. Has .htaccess been hacked?
- htaccess problem after saving Settings
- Protecting direct access to PDF and ZIP unless user logged in (without plugin)
- Stop WordPress and Plugins from Overwriting .htaccess
- How to fake a WordPress login?
- htaccess disable WordPress rewrite rules for folder and its contents
- htaccess rewrite conflict with wordpress rules and ssl
- htaccess https redirect from www to non-www
- What does a security risk in a plugin look like?
- Brute force attack?
- Htaccess for Wordpess set on single subdomain
- Securing wp-admin folder – Purpose? Importance?
- .htaccess and 500 error, extra character added
- Name-based virtual host configuration in Apache seems to cause a “500 Internal Server Error”
- Place static HTML files in path below WordPress page
- wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability
- Static raw HTML page
- WordPress + Magento .htaccess ReWriteRule Issue (www vs. non-www)
- Plugin to edit htaccess file
- htaccess rewrite for author query string when WP is in subfolder
- Why “Settings->Permalinks” creates .htaccess file on nginx server?
- .htaccess for wordpress inside another wordpress install
- .htaccess file redirecting to parent directory
- Blog.php or how to display recent posts?
- Options for restricting access to wp-admin
- Rewrite /?rest_route=/ link to /wp-json/ without changing default permalink structure in apache
- Globally force SSL on all pages
- Serve apache 404 for missing assets rather then wp 404 template WP_Rewrites
- Isolating WordPress to a subfolder
- Remove year and month in URL using .htaccess
- index.php not loading in main folder of wordpress
- Admin-Ajax.php, SSL, Non-SSL
- How to Block Access to Standard Login Flow and Comment Flow
- How disable SSL redirect for specific URL?
- How to secure WordPress XMLRPC?
- brute force attack even though it is limited by IP
- WordPress site displaying 404 for any page apart from index
- Which ways can be used to log in to WordPress?
- Why does the header set X-Robots-Tag apply to all pages?
- Permalinks not working on second wordpress installed in a subdirect
- How to avoid wordpress permalink rules to inherit in a sub-folder
- How to change “wp-admin” to something else without search-replacing the core?
- Error:406 not acceptable
- Unable to access WP admin
- .htaccess Rewrite URL WordPress
- Move wordpress to folder without changing urls
- Rewrite rule not working
- A plugin changes my .htaccess file and I can’t access httpd.conf as that’s a shared server
- Cant block wordpress readme files
- Change wp-content without changing the name of the folder
- 404/500 error on /wp-json
- WordPress keeps deleting .htaccess file
- Correct htaccess to display page while also passing in GET parameters
- What is the role of .htaccess file in WordPress?
- How to prevent bot or someone to modify any file automatically?
- How to disable XML-RPC from Linux command-line in a total way?
- Using WordPress only for the backend, and using AngularJS as a frontend
- Temporary .htaccess blocking is disabling WP Crons from running?
- Block access to wp-admin
- How to restrict access to wp-content, wp-includes and all sub-folders
- Two domains on one WordPress Installation
- .htaccess redirects disappeared after re-saving permalinks
- Protect Upload Folder Files With Ampersand Problem
- How have I misconfigured basic auth for my wordpress site?
- Remove File Extension for Page Outside of WordPress