Checking for origin of a xmlrpc request

I guess there is $_SERVER['HTTP_ORIGIN'] property which can be helpful for this point, or even HTTP_REFERER, hooking into the init hook to make sure nothing runs until this origin is allowed, something like:

add_action("init", function() {
    global $pagenow;
    if ( "xmlrpc.php" !== $pagenow ) return; // xmlrpc.php only
    $domains = array( "example.com" ); // domains to allow
    if( !isset($_SERVER['HTTP_ORIGIN']) || !in_array($_SERVER['HTTP_ORIGIN'], $domains) ) {
        exit('No requests allowed from this origin.');
    } return;
}, 0);

I have hooked into init and used global $pagenow because I did not find any other hook to be listened to initially in that file.

Hope that helps with your practice.