XML-RPC Decision SOP

XML-RPC Decision SOP
Kill XML-RPC entirely or restrict it. Decide by what still needs it.

— Disable fully when: no Jetpack, no mobile app, no remote publishing. Block at nginx/Apache, not just PHP, so the endpoint never executes.
— Restrict (not disable) when: Jetpack or the WordPress app is in use. Whitelist Automattic IP ranges, block everyone else.
— Never rely on a plugin toggle alone: server-level block survives plugin failure and theme switches.
— Specifically kill system.multicall: it's the amplifier for brute-force and pingback DDoS.
— Verify: POST to /xmlrpc.php and confirm 403 from the web server, not a 200 with an XML fault.

Run this on every WordPress install.