Yeah, I guess it's a bit like a sitemap really, but more for servers (or even clients or intermediaries like Cloudflare) to validate requests before they so muc

Yeah, I guess it's a bit like a sitemap really, but more for servers (or even clients or intermediaries like Cloudflare) to validate requests before they so much get anywhere near an actual app process. It would also let you do things like remove files like WordPress's xml_rpc.php (but without actually removing the file) if you don't use that feature at all - no idea about nowadays, but it used to be a very common attack vector that I'd always rename.