TL;DR

For a site that does not need XML-RPC, WP fail2ban Premium can close the interface completely. Every request is refused and becomes a hard event that fail2ban can enforce at the host firewall.

If you need Jetpack, a trusted integration, or pingbacks, use a narrower XML-RPC policy instead.

Remove an interface with no job

WP fail2ban lets you make the site's position explicit. When XML-RPC has no job, Premium refuses the request and records that it reached an interface you have deliberately closed.

Closing an interface your site does not use reduces the available attack surface and avoids processing probes, authentication attempts, and malformed traffic that have no legitimate purpose there.

Turn the policy violation into a strong signal

A request to an open XML-RPC endpoint can be legitimate. A request to an endpoint your site has explicitly closed cannot be.

WP fail2ban records the blocked request as a hard event. A configured fail2ban jail can act on that certainty at the host firewall, stopping further connections from the same source before WordPress processes them.

Choose a narrower policy when you need one

A site that uses Jetpack or another integration with stable source addresses can admit those callers while keeping the endpoint closed to everyone else. A site that wants pingbacks but has no full XML-RPC client can expose only the pingback method instead.

These are alternative policies. Do not combine a source allowlist with pingbacks-only: limiting the interface to pingbacks also prevents an allowed full client from using the other methods it needs.

More about allowing Jetpack without opening XML-RPC.

More about allowing trusted IPs to use XML-RPC.

More about allowing pingbacks responsibly.

Check what your site depends on

XML-RPC can operate quietly in the background. Jetpack, mobile publishing apps, remote management tools, and custom integrations may depend on it even when site visitors never see it.

Identify the clients your site uses before applying a complete block. If you find a dependency, use one of WP fail2ban's narrower policies instead.

More about XML-RPC policy.