Disabling XML-RPC not working

Hi @phonyroyal,

Indeed, the plugin does not add rules to the .htaccess file to block XML-RPC access. Instead, it uses WordPress’s built-in filter system to disable XML-RPC functionality (at the application level).

Please find the relevant code that the plugin uses to disable/block XML-RPC requests on this GitHub link: https://github.com/Really-Simple-Plugins/really-simple-ssl/blob/master/security/wordpress/disable-xmlrpc.php

Those external detection tools are likely designed to detect a server-level block to xmlrpc.php rather than disabling it via WordPress filters (like the xmlrpc_enabled filter which disables the XML-RPC methods if it returns false).

Kind regards, Jarno