XML-RPC allows remote connections to your WordPress site (e.g. from the app or for Pingbacks). Most sites do not need it, and it can be exploited. To disable, add to your functions.php file. For more tips on securing your WordPress site.
add_filter( 'xmlrpc_enabled', '__return_false' );