Since WordPress 3.5, the core developers have decided to keep xml rpc enabled by default and there are no options in the Admin to disable it.

This blog post explains how to disable it by modifying the xmlrpc_enabled filter

add_filter('xmlrpc_enabled', '__return_false');

But this doesn't seem to work, I still get the following on the generated HTML

<link rel="EditURI" type="application/rsd+xml" title="RSD" href="http://domain.com/xmlrpc.php?rsd" />

and WordPress still generates the http://example.com/xmlrpc.php?rsd page

I'm putting the filter in the functions.php file of my theme.

1 Answer 1


To remove the HTML link:

remove_action( 'wp_head', 'rsd_link' );

To stop all requests to xmlrpc.php for RSD per XML-RPC:

if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) )

This is plugin territory. Never use this code in a theme.

  • I'm building an app in WordPress (and thus putting all functionality in the theme). Otherwise, I'm aware of the rsd_link action, but looking for clean way to switch off xml rpc.
    – Omar Abid
    Jan 8, 2013 at 23:43
  • There is no reason to build an app as theme, quite contrary it should be a plugin. You can use register_theme_directory() to add a custom theme from the directory of your plugin.
    – fuxia
    Jan 8, 2013 at 23:47
  • I was going the plugin way, but found that using a Theme will help me avoid many headaches with register_theme_directory(), so I did it the easy way ;).
    – Omar Abid
    Jan 8, 2013 at 23:49
  • As you can see xmlrpc.php is out of reach for a theme.
    – fuxia
    Jan 8, 2013 at 23:50
  • 1
    I thought the choice had to do with semantics. Does that mean that functions.php has some limitations? If so, where can I find these limitations?
    – Omar Abid
    Jan 8, 2013 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.