Security: XMLRPC

Disables XML-RPC, removes pingback discovery and methods, and rejects

direct xmlrpc.php requests.

Capabilities and extension points

Disables XML-RPC, removes pingback discovery and methods, and rejects

direct xmlrpc.php requests.

This policy also affects external clients that depend on XML-RPC. Assess those integrations before using this theme for a site that requires them.

Registers hooks for disabling XML-RPC.

Reports XML-RPC as disabled.

• return bool

Removes the X-Pingback header from the response.

• param array $headers Response headers.
• return array Headers without the X-Pingback entry.

Removes the RSD and Windows Live Writer discovery links from the head.

Strips the pingback methods from the available XML-RPC methods.

• param array $methods Available XML-RPC methods.
• return array Methods without pingback support.

Blocks direct requests to xmlrpc.php as defense in depth, on top of

the `xmlrpc_enabled` filter above.

Source reference

This editable reference page is based on the PHP documentation in security/class-xmlrpc.php.