Disable XML-RPC with AI

Close the /xmlrpc.php brute-force and pingback door that most sites leave open by default.

Difficulty Beginner

Time ~5 min

Tools run_wp_cli, rest_api

Prerequisites

A connected site. Note: disabling XML-RPC breaks classic Jetpack and the WordPress mobile app if you use them.

The prompt

Check whether XML-RPC is enabled on [your-site-url] and, if it is, disable it safely.

1. First, tell me whether /xmlrpc.php is reachable and responding on my site. Do not change anything yet.

2. Check whether I have Jetpack, the WordPress mobile app, or any remote-publishing or automation tools active that rely on XML-RPC. If so, warn me before we continue, because disabling XML-RPC will break them.

3. If I confirm I do not need XML-RPC, install and activate a well-reviewed, lightweight plugin that disables it, blocking the login and pingback methods that attackers use. Do not edit my theme files or server config.

4. Verify the change: test the endpoint again and confirm the authenticated XML-RPC methods now return that the service is disabled, so I know it actually worked.

Tell me exactly what you installed and how to reverse it if I ever need XML-RPC back.

Already connected to WPVibe?

Skip the copy-paste. Just ask your AI for the “Disable XML-RPC with AI” recipe, or describe the task, and WPVibe runs these steps on your own site.

XML-RPC is an old remote-control endpoint that sits at /xmlrpc.php on almost every WordPress site. Attackers know it well: one request can try hundreds of passwords at once through the login methods, and the pingback method can be abused to bounce denial-of-service traffic through your site at someone else. Most sites stopped needing XML-RPC years ago, but it stays switched on by default, quietly answering every bot that comes knocking. Turning it off usually means editing files or guessing which plugin to trust, and that friction is enough that it never gets done.

Connected to your site, the AI first checks whether XML-RPC is actually reachable and responding. If it is, it installs and activates a trusted, lightweight plugin that blocks the authenticated and pingback methods (the parts attackers abuse) while leaving your dashboard and publishing untouched. Then it tests the endpoint again and confirms those methods now report that the service is disabled, so you are not taking anyone’s word that it worked. It never edits your theme files or server config to do this.

Paste the prompt and let it check before it changes anything. One caution worth knowing: a few tools still depend on XML-RPC, mainly the classic Jetpack connection, the WordPress mobile app, and some remote-publishing or automation setups. The prompt asks the AI to look for Jetpack and warn you before disabling anything, and turning XML-RPC back on later is as simple as removing the plugin it installed.

Outcome

XML-RPC authenticated and pingback methods are blocked, verified against the live endpoint.