1
CleanTalk Spam Protection Partial
Blocks XML-RPC pingbacks and checks some plugin REST routes; no general API lockdown.
85feature score
WordPress CAPTCHA & Anti-Spam Plugins with REST API & XML-RPC protection
Blocks spam or abuse through the REST API or XML-RPC. 4 of the 9 plugins we track include it.
2
hCaptcha for WordPress Partial
Option to disable authenticated XML-RPC requests; no REST API restriction.
84feature score
3
Akismet Anti-spam Partial
Filters spam pingbacks (sent via XML-RPC); no wider REST API or XML-RPC protection.
43feature score
4
Antispam Bee Partial
Checks incoming pingbacks (via XML-RPC) and trackbacks; no wider REST or XML-RPC blocking.
25feature score