//add to functions.php
add_filter( 'xmlrpc_enabled', '__return_false' );

//add to .htaccess
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>