XML-RPC Protocol Checker

XML-RPC Protocol Checker compared with WPScan and Sucuri SiteCheck
XML-RPC Protocol Checker (xmlrpc.blog)	WPScan	Sucuri SiteCheck
Scope: It does one thing: it tests whether a WordPress site still has the XML-RPC protocol active. Kinsta names it as the validation service to use for this test.	Scope: The WPScan plugin checks a site against the WPScan vulnerability database for known core, plugin and theme flaws. Among its extra checks is whether XML-RPC is enabled.	Scope: It scans a URL for known malware, blacklist status, outdated CMS software and vulnerable plugins. The page does not list an XML-RPC check.
Technical basis: Checking that xmlrpc.php exists proves nothing, because the file is part of every WordPress installation even when XML-RPC is disabled. A functional test of the endpoint is needed instead.	Technical basis: The plugin runs inside WordPress and needs an API token from wpscan.com for vulnerability lookups. XML-RPC and a few other checks work without a token.	Technical basis: It is a remote scanner. It sees only what is visible at browser level and cannot detect server-side problems, and results are not guaranteed.
	Cost and status: The free plan allows 25 API requests per day, one per core version, plugin or theme. The plugin page states it is no longer actively supported for non-enterprise customers and recommends Jetpack Protect.	Cost and status: The scanner is described as free. A full client and server level scan requires contacting Sucuri.
Why the check matters: XML-RPC has been on by default since WordPress 3.5. Risks cited are DDoS through pingbacks and brute force attempts, since each request carries credentials.

XML-RPC Protocol Checker compared with WPScan and Sucuri SiteCheck

XML-RPC Protocol Checker (xmlrpc.blog)

WPScan

Sucuri SiteCheck

Scope: It does one thing: it tests whether a WordPress site still has the XML-RPC protocol active. Kinsta names it as the validation service to use for this test.

Scope: The WPScan plugin checks a site against the WPScan vulnerability database for known core, plugin and theme flaws. Among its extra checks is whether XML-RPC is enabled.

Scope: It scans a URL for known malware, blacklist status, outdated CMS software and vulnerable plugins. The page does not list an XML-RPC check.

Technical basis: Checking that xmlrpc.php exists proves nothing, because the file is part of every WordPress installation even when XML-RPC is disabled. A functional test of the endpoint is needed instead.

Technical basis: The plugin runs inside WordPress and needs an API token from wpscan.com for vulnerability lookups. XML-RPC and a few other checks work without a token.

Technical basis: It is a remote scanner. It sees only what is visible at browser level and cannot detect server-side problems, and results are not guaranteed.

Cost and status: The free plan allows 25 API requests per day, one per core version, plugin or theme. The plugin page states it is no longer actively supported for non-enterprise customers and recommends Jetpack Protect.

Cost and status: The scanner is described as free. A full client and server level scan requires contacting Sucuri.

Why the check matters: XML-RPC has been on by default since WordPress 3.5. Risks cited are DDoS through pingbacks and brute force attempts, since each request carries credentials.