--- title: The lock set is complete: WP Pro Admin 2.1.0 description: Three more locks — Registration Lockdown, Disable XML-RPC and Disable File Editing — complete the promise: nothing appears on your site without you. pubDate: 2026-08-08 source: https://wpproadmin.com/blog/wp-pro-admin-2-1-0-six-locks/ --- WP Pro Admin 2.1.0 adds the last three locks. The set now covers the whole promise: **no new comments, no new plugins, no new versions, no new users, no remote write API, no code edits.** All three ship switched off. Nothing changes on your site until you turn one on. ## Registration Lockdown Creating a rogue administrator is what an attacker does first, because it outlives the backdoor they came in through. - "Anyone can register" is forced off **by filter** — it holds even if something flips the option row in the database directly. - Creation of, or promotion to, **administrator** is refused. This layer is on by default: it stops the actual attack and leaves ordinary customer registration alone. - Blocking accounts created by plugin code is available but off by default, because it breaks WooCommerce checkout and membership plugins. - Blocked administrator attempts are logged with the time and requested username. The full walkthrough is in [how to stop spam user registration in WordPress](/guides/stop-spam-user-registration-wordpress/). ## Disable XML-RPC Closes `xmlrpc.php` and removes every method, including `pingback.ping` and `system.multicall` — the one that lets a single request carry hundreds of password guesses. The X-Pingback header and RSD discovery link go too, so the site stops advertising the API. If you use the Jetpack mobile app or a legacy remote publishing tool, leave this off. More in [should you disable XML-RPC?](/guides/disable-xmlrpc-wordpress/) ## Disable File Editing Removes the built-in plugin and theme file editors. A stolen administrator session is otherwise one click away from running arbitrary PHP. It's the natural pair to Installation Lockdown: that stops new code arriving, this stops the code already there being rewritten. It's a capability filter rather than the `DISALLOW_FILE_EDIT` constant, so it's always reversible from the settings screen. ## What's next 2.2.0 brings the content tools: Duplicate, Live Draft, Keep URL, Order and Replace Media — the everyday editing jobs that should have been built into WordPress. The [guides](/guides/) already cover how each one will work. [Download the latest release](/download.zip), or read the [installation docs](/docs/installation/) to get started. This release ships with 146 tests and 546 assertions.