In reply to djsteveb.

Hey djsteveb, it's all good and I'll try to be brief. ;)

I can do all this – but it is NOT trivial. And I consider myself a fairly advanced WP user.

Are you doing this because you need to or you think you need to? I'm not being pedantic or snarky. XML-RPC is a problem if you don't have strong passwords. So is wp-login.php for the same reason and I don't see people rushing to turn that off somehow.

Despite the press, out of the box WordPress isn't insecure. I've never used a "security" plugin. It's not that I'm lucky, it's that I maintain my software. Even that can be automated.

If you want to disable XML-RPC (and I'm cool with that) then it's just one line of code in a plugin or your theme's functions.php file.

add_filter( 'xmlrpc_enabled', '__return_false' );

I had to look at a plugin to find it myself. I also knew it was one line in a plugin; I looked at it before.

https://developer.wordpress.org/reference/hooks/xmlrpc_enabled/

Note that I don't disable XML-RPC myself. I know that there's a ton of misinformation about XML-RPC and WordPress but there's really no need to disable it if you take normal precautions about your passwords.

During previous WP upgrades I was not aware that WP was installing extra third party stuff – and had unknowingly sacrificed the privacy of my visitors and my crew.

I'm going to skip the privacy conversation and just point out that Emoji is a little more lines to disable but that's simple too. Look at the source for this plugin.

https://wordpress.org/plugins/disable-emojis/

Otto wrote a plugin that will not only disabled them but replaced them with original the classic smileys.

https://wordpress.org/plugins/classic-smilies/

The point I am trying to make is that each time WordPress adds a new feature or enhancement, there is always a way to disable it in code, if you feel the need to do so.

Yes, new features are enabled by default. Disabled features never get turned on and never get adopted. But there has never been a feature added that the core team felt was not good and secure. That includes the much maligned XML-RPC code.

The oEmbed provider is targeted at the majority of the users. Just like RSS, people want to make their posts available for consumption. This is just a new cool way to do that.

I will always support anyone who wants to disable features on their own site. Anyone on the support team would, it's your site or in some cases thousands of sites. The support forums are a good place to ask. ;)

https://wordpress.org/support/forum/how-to-and-troubleshooting#postform

But what I won't support is someone taking their case and trying to apply it to everyone else. The design decisions that the core team make is based on helping the majority. Disabling these new features by default aren't that.