New answers tagged

0

While what you used appears to work for now, I couldn't guarantee it isn't going to cause other issues now or in the future because - as you already know - tricking is_admin_bar_showing() isn't what the check of the XMLRPC_REQUEST constant was designed for. Therefore even if it doesn't cause issues now I don't think it would future-proof to use it like this. ...


2

I guess there is $_SERVER['HTTP_ORIGIN'] property which can be helpful for this point, or even HTTP_REFERER, hooking into the init hook to make sure nothing runs until this origin is allowed, something like: add_action("init", function() { global $pagenow; if ( "xmlrpc.php" !== $pagenow ) return; // xmlrpc.php only $domains = array( "example.com"...



Top 50 recent answers are included