XML-RPC 协议检测器 | Innovation.world

XML-RPC Protocol Checker compared with WPScan and Sucuri SiteCheck
XML-RPC Protocol Checker (xmlrpc.blog)	WPScan	Sucuri SiteCheck
范围： It does one thing: it tests whether a WordPress site still has the XML-RPC protocol active. Kinsta names it as the validation service to use for this test.	范围： The WPScan plugin checks a site against the WPScan vulnerability database for known core, plugin and theme flaws. Among its extra checks is whether XML-RPC is enabled.	范围： It scans a URL for known malware, blacklist status, outdated CMS software and vulnerable plugins. The page does not list an XML-RPC check.
技术基础： Checking that xmlrpc.php exists proves nothing, because the file is part of every WordPress installation even when XML-RPC is disabled. A functional test of the endpoint is needed instead.	技术基础： The plugin runs inside WordPress and needs an API token from wpscan.com for vulnerability lookups. XML-RPC and a few other checks work without a token.	技术基础： It is a remote scanner. It sees only what is visible at browser level and cannot detect server-side problems, and results are not guaranteed.
	Cost and status: The free plan allows 25 API requests per day, one per core version, plugin or theme. The plugin page states it is no longer actively supported for non-enterprise customers and recommends Jetpack Protect.	Cost and status: The scanner is described as free. A full client and server level scan requires contacting Sucuri.
Why the check matters: XML-RPC has been on by default since WordPress 3.5. Risks cited are DDoS through pingbacks and brute force attempts, since each request carries credentials.

XML-RPC Protocol Checker compared with WPScan and Sucuri SiteCheck

XML-RPC Protocol Checker (xmlrpc.blog)

WPScan

Sucuri SiteCheck

范围： It does one thing: it tests whether a WordPress site still has the XML-RPC protocol active. Kinsta names it as the validation service to use for this test.

范围： The WPScan plugin checks a site against the WPScan vulnerability database for known core, plugin and theme flaws. Among its extra checks is whether XML-RPC is enabled.

范围： It scans a URL for known malware, blacklist status, outdated CMS software and vulnerable plugins. The page does not list an XML-RPC check.

技术基础： Checking that xmlrpc.php exists proves nothing, because the file is part of every WordPress installation even when XML-RPC is disabled. A functional test of the endpoint is needed instead.

技术基础： The plugin runs inside WordPress and needs an API token from wpscan.com for vulnerability lookups. XML-RPC and a few other checks work without a token.

技术基础： It is a remote scanner. It sees only what is visible at browser level and cannot detect server-side problems, and results are not guaranteed.

Cost and status: The free plan allows 25 API requests per day, one per core version, plugin or theme. The plugin page states it is no longer actively supported for non-enterprise customers and recommends Jetpack Protect.

Cost and status: The scanner is described as free. A full client and server level scan requires contacting Sucuri.

Why the check matters: XML-RPC has been on by default since WordPress 3.5. Risks cited are DDoS through pingbacks and brute force attempts, since each request carries credentials.