How to Disable XML-RPC in WordPress
All you have to do is paste the following code in a site-specific plugin:
add_filter('xmlrpc_enabled', '__return_false');
Alternatively, you can just install the plugin called Disable XML-RPC. All you have to do is activate it. It does the exact same thing as the code above.
How to Disable WordPress XML-RPC with .htaccess
While the above solution is sufficient for many, it can still be resource intensive for sites that are getting attacked.
In those cases, you may want to disable all xmlrpc.php requests from the .htaccess file before the request is even passed onto WordPress.
Simply paste the following code in your .htaccess file:
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
