WP XML RPC Guardian
Secure your WordPress site by protecting and disabling XML-RPC requests with the XML RPC Guardian plugin.
Descriptions
Overview
XML-RPC Guardian is an enterprise-grade WordPress security plugin that shields your site from devastating XML-RPC brute force attacks. Built by veteran WordPress engineers with over a decade of security experience, it blocks dangerous exploits while maintaining full compatibility with Jetpack and mobile applications—protection that doesn't break the features you depend on.
Why Website Owners Choose XML-RPC Guardian
- Bulletproof Brute Force Protection: Automatically blocks XML-RPC login attacks and massive password guessing that defeat normal security plugins
- Never Break Jetpack or Mobile Apps: Intelligent filters keep everything running—only attackers are stopped
- Real-Time Monitoring: Instantly see blocked threats and security events from your dashboard
- No Technical Setup Needed: Activate and get industry-grade protection out-of-the-box
- Compliant & Lightweight: Clean code, no bloat, ready for the latest WordPress and PHP
- Peace of Mind: Designed and supported from Canada by experts with 10+ years in WordPress security
Perfect For
- Business, community, or client WordPress sites
- Sites tired of unexplained lockouts or crash reports from XML-RPC
- Users who demand security and full compatibility (Jetpack, Automattic, apps)
Frequently Asked Questions
Q: Will Jetpack or mobile apps break?
A: No! Unlike "disable XML-RPC" plugins, Guardian keeps legitimate integrations working.
Q: What's required?
A: WordPress 5.8+ and PHP 7.4+. No coding skills needed.
Q: How do I install?
A: Upload, activate, and receive instant protection.
Enterprise-Grade Security Features
- Advanced Method Filtering: Blocks pingback.ping, system.multicall, and other high-risk methods
- IP Access Control: Allowlist and blocklist with IPv4/IPv6 CIDR support and proxy awareness
- Rate Limiting Protection: Per-IP throttling (10–1000 requests per 60–3600s) with retry-after headers
- Application Password Enforcement: Forces use of WordPress application passwords for XML-RPC
- Real-time Monitoring: Detailed security logging of blocked requests and events
Three Security Modes
- Default Mode: Safe removals only—blocks high-risk methods, allows others
- Allowlist Mode: Strict—only specified methods permitted
- Blocklist Mode: Flexible—only specified methods blocked
Why Choose XML-RPC Guardian
- Jetpack Compatibility: Maintains full Jetpack functionality
- Mobile App Support: Pre-configured profiles for WordPress mobile apps
- Zero Configuration: Secure defaults out of the box
- Professional Logging: Detailed logs for compliance
- Expert Support: Comprehensive documentation and updates
Requirements
WordPress Versions:
- Minimum: 5.8+
- Tested: 6.0, 6.1, 6.2, 6.3, 6.4, 6.6, 6.8, 6.8.2
- Future: Compatible with upcoming releases
PHP Versions:
- Minimum: 7.4
- Recommended: 8.0+
- Tested: 7.4, 8.0, 8.1, 8.2, 8.3
Instructions
- Upload the plugin files to
/wp-content/plugins/xmlrpc-guardian/ - Activate the plugin through the 'Plugins' menu in WordPress
- Configure settings under Settings → XML-RPC Guardian
Hex Information (For Shop Owner): 58137
Add a review