Bots scan millions of sites per hour. They look for standard WordPress paths like /wp-admin, /wp-login.php, and /wp-content/plugins/, signals that scream: "this is WordPress, attack it." Traditional security plugins catch the attack once it has already started. But what if the bot doesn't even realize it's looking at WordPress?

WP Ghost (formerly Hide My WP Ghost) changes the rules of the game. Instead of putting up a shield and waiting for the hit, it removes the very cause of the attack: WordPress fingerprints. The bot sees an unfamiliar CMS with no known paths and moves on to find an easier target. No magic here: just an architectural approach to security that, according to the developer, reduces the attack surface by up to 90% before the attack even begins.

Here's how WP Ghost protects your WordPress site, what the free version offers, and whether Premium is worth it.

💡 Quick overview:

• Change /wp-admin and /wp-login.php to unique URLs so bots lose their entry point
• Enable the built-in 8G firewall to block SQL injections and XSS
• Set up Passkey or two-factor authentication for passwordless login
• Remove WordPress traces from source code, meta tags, and plugin paths
• Complete the setup wizard in 5 minutes and get a security score of 80+

What is WP Ghost and why hide WordPress

WP Ghost is a security plugin that works proactively. Unlike Wordfence or Solid Security, it doesn't wait for an attack to block it. It makes your site invisible to bots specifically looking for WordPress.

The principle is simple. A hacking bot receives a list of URLs and checks them one by one. Found /wp-content/, confirmed WordPress. Found wp-login.php, launched brute force. Found /wp-json/wp/v2/users, scraped usernames. Each of these paths is a signal to attack.

WP Ghost renames these paths at the server rules level. Files physically remain in place, but from the outside the site looks like a custom CMS without a single hint of WordPress. The bot doesn't find familiar paths and leaves.

The plugin has been developing since 2014, evolving from a niche solution on CodeCanyon to a professional tool on WordPress.org with an audience of 100,000+ users. In 2026, WP Ghost blocks 10 million brute force attempts and 100 million threats monthly.

Key features

Path hiding and file renaming

The plugin's core is the Paths Security module. It changes all standard URLs that reveal WordPress:

• /wp-admin and /wp-login.php: your admin panel moves to a unique address. When accessing the old one, the bot sees a 404

• System folders /wp-content, /wp-includes, and /wp-content/uploads are masked

• /wp-json and admin-ajax.php: REST API and AJAX endpoints are hidden from scanners

• Plugins and themes: paths to them are anonymized so bots cannot determine versions and names

Three security presets, from minimal compatibility to maximum protection, let you enable hiding in one click. For each changed path, the plugin runs a frontend test: it verifies the site loads correctly before applying the settings.

Built-in 8G firewall and brute force protection

WP Ghost includes a lightweight server-side 8G firewall (and 7G for backward compatibility). Unlike bulky WAF solutions, it filters traffic at the server level: fast, without delays, with minimal load.

The firewall blocks SQL injections, XSS attacks, malicious XML-RPC requests, and vulnerability scanners. All blocked attempts are logged in the threat journal with filtering by type, country, and time.

Brute force protection supports Google reCaptcha (V2, V3, Enterprise) and math captcha. It can be configured for login, registration, and WooCommerce forms. You can set attempt limits and block duration. IP addresses exceeding the limit automatically go to the blacklist.

Two-factor authentication and Passkey

Besides standard 2FA via code or email, WP Ghost supports Passkey, biometric login. Face ID, Touch ID, Windows Hello: the user places a finger or looks into the camera instead of typing a password. Phishing is impossible with this authentication: Passkey is tied to the device and domain, and it cannot be stolen remotely.

For developers and clients, there's the Temporary Logins feature: one-time links with limited validity. No need to create an account and then delete it.

Deep digital footprint hiding

WP Ghost removes WordPress from the page source code: it strips the version from meta tags, cleans HTML comments, disables RSD links and emoji scripts. It includes optional right-click blocking and "View Source" on the frontend. This isn't a silver bullet, but it creates a barrier for manual reconnaissance.

The Text Mapping feature dynamically replaces CSS class names and IDs in the source code. URL Mapping rewrites internal URLs. A bot looking for wp-content/themes/twentytwentyfour sees assets/design/main and doesn't understand what it's dealing with.

Quick setup: from installation to protection in 5 minutes

Installation is standard: Plugins → Add New → "WP Ghost" → Install → Activate.

After activation, the plugin opens a setup wizard. You choose one of three levels: Low (maximum compatibility, minimum paths changed), Medium (golden middle), or Ghost Mode (Premium, complete hiding of everything). The plugin applies the preset, runs a frontend test, and shows a security score: a real number from 0 to 100 reflecting how well protected the site is right now.

The login page designer deserves special mention: 10 color schemes, custom logo, background. Your hidden /newlogin looks not like standard WordPress but like a custom login page.

The plugin is compatible with Apache, Nginx, LiteSpeed, and IIS. It works with WP Rocket, Cloudflare, Elementor, WooCommerce, WPML, and dozens of other plugins. Confirmed hosting support: Kinsta, WP Engine, Cloudways, SiteGround.

Free version vs Premium: what to choose

WP Ghost is one of the most generous free security plugins: 115+ features are available without payment. Here's what each version offers:

The free version is enough for a blog, landing page, or small online store. Premium is needed for agencies, high-traffic projects, and sites with increased logging requirements.

Comparison with alternatives

WP Ghost is not the only plugin for hiding WordPress. Here are the key differences from competitors:

WP Ghost wins on the "free features / Premium price" ratio. WP Hide is a worthy alternative with a focus specifically on hiding (without a firewall). Solid Security is a powerful all-in-one solution but without the path changing feature.

⁉️🤔 Frequently asked questions

Does changing paths break plugins and themes?

Most plugins and themes work with WordPress through internal APIs and don't depend on external URLs. WP Ghost changes only publicly visible paths; internal links remain untouched. The frontend test checks the loading of each page before applying settings. The plugin has confirmed compatibility with WooCommerce, Elementor, WPML, and dozens of others.

Does WP Ghost slow down the site?

No. WP Ghost uses server rewrite rules, not JavaScript redirects or on-the-fly scanning. The 8G firewall is lightweight and works at the server level before WordPress loads. With caching enabled (WP Rocket, Cloudflare), additional load approaches zero.

What happens if I delete the plugin?

When you delete the plugin, all changed paths return to standard. The site becomes visible as WordPress again. No files are damaged, the database is unaffected; WP Ghost doesn't physically change content, only routing rules.

Can I use WP Ghost together with Wordfence?

Yes, this is the recommended stack. Wordfence covers attacks at the application level (signature analysis, malware scanner), while WP Ghost removes the very possibility of detecting WordPress. Together they provide two-level protection: hiding plus active blocking. There are no conflicts between the plugins.

Does the plugin work on Nginx and LiteSpeed?

Yes. WP Ghost supports Apache, Nginx, LiteSpeed, and IIS. For Nginx, the plugin generates rules that need to be inserted into the server configuration (instructions in the admin panel). On LiteSpeed, it works out of the box; there's a ready compatibility module for optimization.

Is Premium worth it for a regular blog?

For a typical blog, the free version is more than enough. You get hiding of all paths, firewall, brute force protection, and Passkey without payment. Premium makes sense when you need a full threat log with export, country blocking, or protection from AI crawlers (GPTBot, ClaudeBot, and 30+ others).

Final verdict: what to install in 2026

WP Ghost solves a problem that most security plugins ignore: it prevents bots from knowing the site runs on WordPress. This is not a replacement for Wordfence or Solid Security. It's the first line of defense that, according to WP Ghost statistics, cuts off most automated attacks at the reconnaissance stage.

If you have a blog, landing page, or small store, install the free version, enable the Medium preset, and sleep soundly. Agencies and multi-site owners should look at Premium for Ghost Mode, AI crawler blocking, and extended logging.

🔗 WP Ghost on WordPress.org | 🔗 Official WP Ghost website