Getting trackback spam, even with trackbacks disabled

Question

I'm having a heck of a time having trackbacks being disabled period on my self-hosted blog. I've disabled the "Allow link notifications from other blogs (pingbacks and trackbacks)" option, and have all comments going through disqus, yet for some reason I'm getting 20-50 trackbacks a day to the blog directly (not through disqus). Is there something obvious that I'm missing?

Answer 1

If you are using a twentyten/eleven theme, they hardcode the pingback meta tag into the head.php file. Remove that line or use your own theme. Also, and maybe it's only in multisite, but the X-Pingback header is sent along with the xmlrpc endpoint url as well. Removed with the following:

/**
 * Remove the X-Pingback header, since pingbacks are disabled
 */
add_filter('wp_headers', 'custom_remove_xmlrpc_header', 1, 2);
function custom_remove_xmlrpc_header($headers, $wp_object){
  if (array_key_exists('X-Pingback', $headers))
    unset($headers['X-Pingback']);
  return $headers;
 }