In reply to djsteveb.

Those are perfectly valid reasons and I totally appreciate why you want and need to disable XML-RPC.

Tell you what though: we've well and truly gone all over the place in these comments. :P

I think for someone who's supporting lots of installations as you've described you might want to write your own short custom plugin. Something small with just a description and the PHP code to do those things you want. The API won't change for years and your plugin won't be parsing any inputs, just making those settings that you personally need and nothing else.

I'm on the support team so this may sound canned: can you start a topic in the support forums about the settings you want to disable?

https://wordpress.org/support/forum/how-to-and-troubleshooting#postform

And post that link to your topic here? What you want isn't a lot of code to maintain. For example, the XML-RPC setting is only a few lines to make it readable.

You'd take that small custom plugin, drop it into your installations, activate it and POOF! you're done. It's even easier with WordPress multisite, just drop the file into the mu-plugins directory.

I can't guarantee that I'll be the one replying to your topic (Tuesdays are the worst for me) but I'm sure it will get some traction.

About the new features that the Core team is adding: new features keeps the platform relevant and modern. The new features are added to solve a problem (the REST API is cool BTW). But they're not always something that everyone will need, appreciate or want. With millions of installations how could they be?

In your case (and others) a little code to maintain isn't a bad solution. Let's see if we can get something working for you, it will definitely help people out.