XML-RPCプロトコルチェッカー

XML-RPC Protocol Checker compared with WPScan and Sucuri SiteCheck
XML-RPC Protocol Checker (xmlrpc.blog)	WPScan	Sucuri SiteCheck
範囲： It does one thing: it tests whether a WordPress site still has the XML-RPC protocol active. Kinsta names it as the validation service to use for this test.	範囲： The WPScan plugin checks a site against the WPScan vulnerability database for known core, plugin and theme flaws. Among its extra checks is whether XML-RPC is enabled.	範囲： It scans a URL for known malware, blacklist status, outdated CMS software and vulnerable plugins. The page does not list an XML-RPC check.
技術的根拠： Checking that xmlrpc.php exists proves nothing, because the file is part of every WordPress installation even when XML-RPC is disabled. A functional test of the endpoint is needed instead.	技術的根拠： The plugin runs inside WordPress and needs an API token from wpscan.com for vulnerability lookups. XML-RPC and a few other checks work without a token.	技術的根拠： It is a remote scanner. It sees only what is visible at browser level and cannot detect server-side problems, and results are not guaranteed.
	Cost and status: The free plan allows 25 API requests per day, one per core version, plugin or theme. The plugin page states it is no longer actively supported for non-enterprise customers and recommends Jetpack Protect.	Cost and status: The scanner is described as free. A full client and server level scan requires contacting Sucuri.
Why the check matters: XML-RPC has been on by default since WordPress 3.5. Risks cited are DDoS through pingbacks and brute force attempts, since each request carries credentials.

XML-RPC Protocol Checker compared with WPScan and Sucuri SiteCheck

XML-RPC Protocol Checker (xmlrpc.blog)

WPScan

Sucuri SiteCheck

範囲： It does one thing: it tests whether a WordPress site still has the XML-RPC protocol active. Kinsta names it as the validation service to use for this test.

範囲： The WPScan plugin checks a site against the WPScan vulnerability database for known core, plugin and theme flaws. Among its extra checks is whether XML-RPC is enabled.

範囲： It scans a URL for known malware, blacklist status, outdated CMS software and vulnerable plugins. The page does not list an XML-RPC check.

技術的根拠： Checking that xmlrpc.php exists proves nothing, because the file is part of every WordPress installation even when XML-RPC is disabled. A functional test of the endpoint is needed instead.

技術的根拠： The plugin runs inside WordPress and needs an API token from wpscan.com for vulnerability lookups. XML-RPC and a few other checks work without a token.

技術的根拠： It is a remote scanner. It sees only what is visible at browser level and cannot detect server-side problems, and results are not guaranteed.

Cost and status: The free plan allows 25 API requests per day, one per core version, plugin or theme. The plugin page states it is no longer actively supported for non-enterprise customers and recommends Jetpack Protect.

Cost and status: The scanner is described as free. A full client and server level scan requires contacting Sucuri.

Why the check matters: XML-RPC has been on by default since WordPress 3.5. Risks cited are DDoS through pingbacks and brute force attempts, since each request carries credentials.