Disable XML-RPC-API

Reviewers split hard here, some say it does exactly what it should, while others report 500 errors and site crashes after activation, plus complaints about cross-promo admin notices and trouble removing it.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

106 searches this plugin appeared in over the last 90 days, 20 listed. 63 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 100% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 24 months ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ mehditabbakh

   5mo ago

   It work perfectly

   Read on wp.org ↗
2. ★★★★★ bugscout

   1.1y ago

   i tried 3 plugins, this does what it should 🙂

   Read on wp.org ↗
3. ★★★★★ firafiki

   1.2y ago

   Website crashed error 500 server. All php files was modified. But i’m not sure who dumb person downloaded at my company website. 4 days to settled all the issues.

   Read on wp.org ↗
4. ★★★★★ elmo2000

   3.2y ago

   My whole site crashed . 500 server error. (.htacces failure) Unistalled, found another solution.

   Read on wp.org ↗
5. ★★★★★ ajaxy12

   3.4y ago

   Could you please add capability to exclude spesific domain names from Disable Hotlinking and Leaching of Your Content section? We want to show some of our content on other webiste via iframe

   Read on wp.org ↗
6. ★★★★★ ben2358723823567

   3.4y ago

   WARNING! This extension will sneakily inject obfuscated yanz backdoor PHP scripts in your document root and will hijack your WordPress site. THREE of my customers websites were hacked this week and the ONLY extension that they all have in common that recently got installed is Disable XML-RPC-API. They literally have nothing else in common and they don’t know each other nor use the same theme nor even the same WordPress release. BE WARNED.

   Read on wp.org ↗
7. ★★★★★ jaywalker999

   3.7y ago

   Any plugin that shoves global notices on every admin page to cross promote their other plugins, can have a one star review and get uninstalled. Bye.

   Read on wp.org ↗
8. ★★★★★ sebastienvercammen

   3.8y ago

   Especially for anyone using WordPress in a professional context, e.g. for clients, this plugin is unusable without manually patching out some code Particularly in the file wp-content/plugins/disable-xml-rpc-api/admin/admin.php, you will find the following: add_action( 'admin_notices', 'dsxmlrpc_admin_notice_wpsg' ); Which repeatedly, without any way to disable it permanently, shows an advertisement for a different plugin called WP Security Guard. The ad says the following: Did you know?You can improve your website security by using WP Security Guard! Learn moreRemind Me LaterNot Intrested! The option Not Intrested! did not disable the notification permanently. It came back. I’m personally not against being contacted by the author of a plugin I actively use, in order to ask whether I might be interested in a more fully-featured professional product – because I legitimately might be interested, and we pay for a lot of our plugins – but nagging everyone in the admin panel, without being able to turn it off, for a product that isn’t even the same one, without mentioning it at the top of the plugin’s description page as a disclaimer before we install, crossed a line. It comes across as unprofessional, without warning, so unusable in a professional context. For users with a personal website looking to disable the notification permanently, they can do so via functions.php or a plugin for PHP code snippets with: add_action( 'init', function() { remove_action( 'admin_notices', 'dsxmlrpc_admin_notice_wpsg' ); }, 11); With this, I hope others are informed. Three stars because, without this advertisement, it does what it says. This topic was modified 3 years, 6 months ago by sebastienvercammen. This topic was modified 3 years, 6 months ago by sebastienvercammen. This topic was modified 3 years, 6 months ago by sebastienvercammen. Reason: Clarify title so people don't think advertising happens everywhere on the website This topic was modified 3 years, 6 months ago by sebastienvercammen. Reason: Proper English title This topic was modified 3 years, 6 months ago by sebastienvercammen. Reason: Clarify that we tried the Not Intrested! option

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.0.0 Initial release 1.0.0
2. — Version 1.0.1 Fix bugs 1.0.1
3. — Version 1.0.5 Remove pingback link tag in header Add ability to fix htaccess file permission 1.0.5
4. — Version 1.0.6 Fix warnings for htaccess permission 1.0.6
5. — Version 1.0.7 Fix blank page when using W3 Total Cache and some other cache plugins 1.0.7
6. — Version 1.0.8 Fix code conflict with Autoptimize plugin 1.0.8

Automated install-time checks, tested on PHP 8.1.12 · WP 6.7.1

Translated into 13 languages, 9 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-11-12 90K+ → 100K+ up after 283 days in tier
2. 2024-02-03 80K+ → 90K+ up after 184 days in tier
3. 2023-08-03 70K+ → 80K+ up after 91 days in tier
4. 2023-05-04 60K+ → 70K+ up after 79 days in tier
5. 2023-02-14 50K+ → 60K+ up after 96 days in tier
6. 2022-11-10 40K+ → 50K+ up after 95 days in tier
7. 2022-08-07 30K+ → 40K+ up after 38 days in tier
8. 2022-06-30 20K+ → 30K+ up after 279 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Disable XML-RPC-API into a readme, a review or a deck. It updates itself.

Disable XML-RPC-API: 100K+ active installs, 4.2★ (43 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/disable-xml-rpc-api