1

I am testing disabling XML-RPC on WP 6.2.2 via the following snippet:

add_filter('xmlrpc_enabled', '__return_false');

But that isn't working. I can still access xmlrpc.php fine. I tried to add it in functions.php, using the WPCode plugin and Code Snippets plugin as well. I can disable XML-RPC fine using the .htaccess code, but I wanted to know if this way still works since this is mentioned in almost every "How to" article about XML-RPC.

1
  • This filter will not change if the file is accessible or not.
    – birgire
    Jun 24, 2023 at 5:54

1 Answer 1

2

From the xmlrpc_enabled filter docs:

Contrary to the way it’s named, this filter does not control whether XML-RPC is fully enabled, rather, it only controls whether XML-RPC methods requiring authentication – such as for publishing purposes – are enabled.

To fully disable XMLRPC, you might be able to use the xmlrpc_methods filter and return an empty array:

add_filter( 'xmlrpc_methods', 'wpse416991_disable_xmlrpc' ); 
/**
 * Disables XMLRPC methods.
 *
 * @param  array $methods The XMLRPC methods.
 * @return array          An empty array to disable all methods.
 */
function wpse416991_disable_xmlrpc( $methods ) {
    return array();
}

Per @birgire's comment, you could further simplify this using __return_empty_array():

add_filter( 'xmlrpc_methods', '__return_empty_array' );

If that doesn't work, you can block access to the XMLRPC file in your .htaccess file (though that's outside of the WordPress scope):

<Files "xmlrpc.php">
    Require all denied
</Files>
2
  • 1
    ps: __return_empty_array() might also become handy to use here
    – birgire
    Jun 24, 2023 at 5:43
  • 1
    Thank you for the explanation. Jun 24, 2023 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.