XML-RPC lets other apps talk to WordPress. Today it is mostly used by bots.
What it was for
Publishing from desktop editors and the old mobile app, and pingbacks between blogs.
Why bots love it
One request can try many passwords, and pingbacks can be abused for attacks.
When you still need it
Some Jetpack features and very old apps. Modern tools use the REST API instead.
Turn it off safely
Disable it with a switch, and turn it back on if something stops working.
Cleanly turns off XML-RPC, and Lockly limits login attempts. See the demo and more speed tweaks.
Frequently asked questions
Does the WordPress mobile app need XML-RPC?
Current versions use the REST API.
Is disabling XML-RPC enough for security?
No, also use strong passwords and limit login attempts.
Will pingbacks stop?
Yes, which most sites do not miss.