메뉴
MU-plugin that completely disables WordPress XML-RPC at the PHP level. Belt-and-suspenders alongside .htaccess blocking. Also removes pingback headers and self-pingbacks. Do not use if you run Jetpack.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Deploy a theme, plugin, or wp-content subset to a WordPress server from a CI/CD pipeline, with automatic pre-deploy backup, post-deploy health check, and automatic rollback on failure. Designed for GitHub Actions, GitLab CI, or any pipeline that can run Python.
Security and integrity audit for WooCommerce stores. Checks REST API key scope, payment gateway exposure, webhook HTTPS enforcement, suspicious $0 orders, exposed wc-logs (PII/payment data), and coupon abuse.
Scaffold and deploy a WordPress child theme via SSH. Generates style.css, functions.php (with correct parent style enqueueing), and index.php. Supports Kadence, Astra, GeneratePress, Hello Elementor, OceanWP, and any custom parent. Can activate the child theme immediately after creation.
Safely switch WordPress themes via SSH with automatic rollback if the site goes down. Records the previous theme for instant rollback. Verifies HTTP 200 before and after the switch.
Security audit of WordPress themes via SSH. Scans for PHP malware patterns, injected scripts, recently modified files, and unexpected file types. Also checks DB for customizer injections and Elementor postmeta payloads. Use after any attack or before going live with a new/inherited theme.
Comprehensive guide to building, maintaining, and recovering Elementor-based WordPress sites. Covers the CSS pipeline, global styles (Kit), common post-attack failures and fixes, Pro vs Free features, and integration with Kadence and Hello Elementor themes.
| name | xmlrpc-kill |
| description | MU-plugin that completely disables WordPress XML-RPC at the PHP level. Belt-and-suspenders alongside .htaccess blocking. Also removes pingback headers and self-pingbacks. Do not use if you run Jetpack. |
| triggers | ["disable xmlrpc","xmlrpc attack","pingback attack","xmlrpc brute force","disable pingbacks"] |
Disables WordPress XML-RPC completely — the xmlrpc_enabled filter, the
xmlrpc_call action hook, pingback headers, and self-pingback functionality.
cp scripts/hardening/mu-plugins/xmlrpc-kill.php \
/path/to/wp-content/mu-plugins/
No configuration required — deploys and works immediately.
system.multicall)Jetpack requires XML-RPC. If you run Jetpack, do not deploy this plugin.
Instead, use wp-firewall.py to restrict xmlrpc.php to Automattic's IP ranges:
python scripts/hardening/wp-firewall.py \
--config config/config.yaml \
--allow-xmlrpc-ip "192.0.64.0/18,192.0.80.0/20"
Other services that use XML-RPC:
| Feature | How |
|---|---|
| XML-RPC API | xmlrpc_enabled filter → false |
| Any XML-RPC call | xmlrpc_call action → wp_die(403) |
RSD link in <head> | rsd_link removed |
WLW manifest in <head> | wlwmanifest_link removed |
X-Pingback header | wp_headers filter |
| Self-pingbacks | pre_ping hook |
curl -s -o /dev/null -w "%{http_code}" \
-X POST https://yoursite.com/xmlrpc.php \
-d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'
# Should return 403