On [`template_redirect`](https://codex.wordpress.org/Plugin_API/Action_Reference/template_redirect) the [`template-loader.php`](https://core.trac.wordpress.org/browser/tags/4.4.2/src/wp-includes/template-loader.php#L28) kicks in.

    add_action( 'template_redirect', function() {

    	if ( in_array( true,
    		array (
    			is_feed(),
    			is_trackback(),
    			is_embed(),
    		) ) ) {
    		wp_die( __( "NO SOUP FOR YOU!" ) );
    	}
    } );
    
If the [`do_feed()`](https://core.trac.wordpress.org/browser/tags/4.4.2/src/wp-includes/functions.php#L1209) is called then a few actions can be invoked.

    add_action( 'init', function() {
    
    	$feeds = array (
    		'do_feed',
    		'do_feed_rdf',
    		'do_feed_rss',
    		'do_feed_rss2',
    		'do_feed_atom',
    	);
    
    	foreach ( $feeds as $feed ) {
    		remove_action( $feed, $feed );
    	} 
    } );

The above feed actions and many others are added in [`default-filters.php`](https://core.trac.wordpress.org/browser/tags/4.4.2/src/wp-includes/default-filters.php)

To disable `xmlrpc`: 

    add_filter( 'xmlrpc_enabled', '__return_false' );

    // Hide xmlrpc.php in HTTP response headers
	add_filter( 'wp_headers', function( $headers ) {
		unset( $headers[ 'X-Pingback' ] );
		return $headers;
	} ); 

To remove links:

    remove_action('wp_head', 'wlwmanifest_link');
    remove_action('wp_head', 'rsd_link');

To block access to `wlwmanifest` and `xmlrpc` add these lines to your [`.htaccess`](https://httpd.apache.org/docs/current/howto/htaccess.html):

    RedirectMatch 403 ^.*/xmlrpc.php$
    RedirectMatch 403 ^.*/wp-includes/wlwmanifest.xml$

For more links to remove you can see [Remove JSON API links in header html](http://wordpress.stackexchange.com/questions/211467/remove-json-api-links-in-header-html) which includes WP-API & oembed links and [Disable emojicons introduced with WP 4.2](http://wordpress.stackexchange.com/questions/185577/disable-emojicons-introduced-with-wp-4-2).