Skip to content

Hardening

Remote access and comments

Every planAbout Hardening

Switches off the old and rarely used ways into WordPress, XML-RPC, pingbacks, trackbacks and application passwords, and can turn comments off across the whole site.

What it does

Disable XML-RPC: XML-RPC is an old remote control for WordPress. Robots love it because one request can try hundreds of passwords. Switching it off refuses every XML-RPC request.

Disable pingbacks and trackbacks: stops other sites from sending automatic "I linked to you" notices, and stops yours sending them. These are mostly used for spam and to make sites attack each other.

Disable application passwords: application passwords let apps sign in without the normal sign-in page, and they skip two-factor sign-in. Switch them off if no app needs them.

Disable comments site-wide: closes comments on every post type and removes the Comments screens from the admin.

Why it matters

Every way in is something that must be defended. Turning off the ways your site never uses is the cheapest protection there is.

Set it up

  1. Go to the Hardening tab, section Attack surface.
  2. Switch on Disable XML-RPC unless you use the old WordPress mobile app, Jetpack or a service that publishes by XML-RPC. The panel warns about known conflicts.
  3. Switch on Disable pingbacks and trackbacks.
  4. Switch on Disable application passwords unless an app or integration signs in with one.
  5. If your site does not use comments, switch on Disable comments site-wide.
  6. Click Save Changes.

Delete all comments

The Comments panel also has Delete All Comments, which permanently removes every comment, approved, pending or spam, from the database. It cannot be undone, so take a backup first.

Which plan includes it

Blocking XML-RPC, pingbacks and comments is in every plan. Disabling application passwords and Delete All Comments are part of Pro.

How it works, for developers
  • XML-RPC: xmlrpc_enabled returns false, xmlrpc_methods returns no methods, the X-Pingback header is removed, and any request to xmlrpc.php gets HTTP 403 on init at priority 1.
  • Pingbacks: the pingback methods are removed from XML-RPC, pings_open returns false (so wp-trackback.php refuses trackbacks), X-Pingback is removed and outgoing pings are emptied (pre_ping, get_to_ping).
  • Application passwords: wp_is_application_passwords_available returns false.
  • Comments: comment and trackback support is removed from all post types on init; comments_open, pings_open, comments_array and get_comments_number are filtered; the menu, admin bar item, dashboard widget and Comments column are removed. Existing comments stay in the database.
  • Delete All Comments empties the comments and commentmeta tables, resets every post's comment count and is written to the activity log.
  • Settings: smg_block_xmlrpc, smg_disable_pingbacks, smg_disable_app_passwords, smg_disable_comments.

Quick answers about remote access and comments

What does Remote access and comments do in Stack Guard?

Disable XML-RPC: XML-RPC is an old remote control for WordPress. Robots love it because one request can try hundreds of passwords. Switching it off refuses every XML-RPC request. Disable pingbacks and trackbacks: stops other sites from sending automatic "I linked to you" notices, and stops yours sending them. These are mostly used for spam and to make sites attack each other. Disable application passwords: application passwords let apps sign in without the normal sign-in page, and they skip two-factor sign-in. Switch them off if no app needs them. Disable comments site-wide: closes comments on every post type and removes the Comments screens from the admin.

Why use remote access and comments on a WordPress site?

Every way in is something that must be defended. Turning off the ways your site never uses is the cheapest protection there is.

How do I set up remote access and comments?

1. Go to the Hardening tab, section Attack surface. 2. Switch on Disable XML-RPC unless you use the old WordPress mobile app, Jetpack or a service that publishes by XML-RPC. The panel warns about known conflicts. 3. Switch on Disable pingbacks and trackbacks. 4. Switch on Disable application passwords unless an app or integration signs in with one. 5. If your site does not use comments, switch on Disable comments site-wide. 6. Click Save Changes.

Which Stack Guard plan includes remote access and comments?

Blocking XML-RPC, pingbacks and comments is in every plan. Disabling application passwords and Delete All Comments are part of Pro.

More in Hardening

Not running Stack Guard yet? It is free.

Download Free