How to disable or restrict Plesk XML API?
It's possible to disable completely the XML API or allow operations only from trusted IP addresses.
To do so, add the following entries to the panel.ini file.
To prohibit all connections via XML API:
enabled = off
To allow connections via XML API only from specific IP addresses:
allowedIPs = 203.0.113.2,192.0.2.2
allowedIPssetting accepts one or more IP addresses separated by commas or whitespace