Add filter to change XML-RPC disabled HTTP status code and default to 403

modules/xml-rpc/class-xml-rpc.php

@@ -58,6 +58,11 @@ public static function disable_xml_rpc() {
 
 		// TODO: Figure how to disable XML-RPC without returning a value.
 		add_filter('wp_xmlrpc_server_class', function ( $server_class ) {
+			/**
+			 * Filters the HTTP status code returned when XML-RPC is disabled.
+			 */
+			status_header( (int) apply_filters( 'vip_security_boost_xml_rpc_disabled_status_code', 403 ) );
+
 			exit( 'Access to XML-RPC is disabled on this site.' );
 			// phpcs:ignore Squiz.PHP.NonExecutableCode.Unreachable
 			return $server_class;

tests/e2e/specs/generic.spec.ts

@@ -63,7 +63,7 @@ test.describe( 'Generic Checks', () => {
 			data: xmlPayload,
 		} );
 
-		expect( response.status() ).toBe( 200 );
+		expect( response.status() ).toBe( 403 );
 		const responseText = await response.text();
 		expect( responseText ).toContain( 'Access to XML-RPC is disabled on this site.' );
 	} );

tests/integration/XmlRpcTest.php

@@ -42,11 +42,11 @@ public function testXmlRpcReturns403WhenDisabled(): void {
 	}
 
 	/**
-	 * Test that accessing XML-RPC endpoint returns 200 OK when module is disabled.
+	 * Test that accessing XML-RPC endpoint returns 403 Forbidden when module is disabled.
 	 *
 	 * @return void
 	 */
-	public function testXmlRpcReturns200WhenModuleDisabled(): void {
+	public function testXmlRpcReturns403WhenModuleDisabled(): void {
 		global $client;
 		$url = '/xmlrpc.php';
 
@@ -73,9 +73,9 @@ public function testXmlRpcReturns200WhenModuleDisabled(): void {
 		]);
 
 		$this->assertEquals(
-			200,
+			403,
 			$response->getStatusCode(),
-			"Expected HTTP status code 200 OK, but received {$response->getStatusCode()}."
+			"Expected HTTP status code 403 Forbidden, but received {$response->getStatusCode()}."
 		);
 	}