Disable XML-RPC Pingbacks and Trackbacks While Keeping Jetpack Active

⚡ Target: functions.php 🔒 Tested: WP 6.6+ / PHP 8.2+ 💻 Lang: PHP

PHP (functions.php)

// Disable XML-RPC pingback methods (Prevents DDoS amplification attacks)
add_filter( 'xmlrpc_methods', function( $methods ) {
    unset( $methods['pingback.ping'] );
    unset( $methods['pingback.extensions.getPingbacks'] );
    return $methods;
} );

// Remove X-Pingback HTTP header from server responses
add_filter( 'wp_headers', function( $headers ) {
    unset( $headers['X-Pingback'] );
    return $headers;
} );

XML-RPC pingbacks are frequently exploited in large-scale DDoS amplification and brute-force attacks. This snippet disables dangerous pingback methods without breaking Jetpack or the official WordPress mobile app.