An out of the box installation of WordPress discloses the version number in the Generator meta tag and in the RSS feeds. Therefore everyone who accesses your website knows what software you are running and which version. This article explains how to hide the WordPress version from the generator meta tag and from the RSS feeds generated by WordPress.
WP White Security Tip: This article is for educational purposes only. By hiding the version of WordPress you do not improve the security of your WordPress. It is always recommended to run the latest version of WordPress to ensure malicious hackers do not exploit known vulnerabilities and hack into your WordPress blogs and websites.
WordPress Version Disclosure in the Generator Meta Tag and RSS Feed
By default WordPress uses the Generator meta tag in the website’s html <head> section to disclose the version number, as seen in the below example:
&amp;amp;amp;amp;lt;meta name=&amp;quot;generator&amp;quot; content=&amp;quot;WordPress 3.5.1&amp;quot; /&amp;amp;amp;amp;gt;
To check if the version of your WordPress is being disclosed or not; navigate to your website, right click anywhere on the website, select “View Page Source” and search for the word generator. The Generator meta tag can be found in the HTML head section, which is all the text in between the <head> and </head> HTML tags.
WordPress also discloses the version number in the default WordPress RSS feed as seen in the below example:
https://wordpress.org/?v=3.5.1
To check if WordPress is disclosing the version in the RSS feed, navigate to your website, add /feed/ or /feed=rss at the end of the URL and search for the word generator. E.g. www.WP White Security.com/feed/.
Hide WordPress Version Number from Generator Meta Tag
To hide the WordPress version number from Generator meta tag, add the below line of code at the bottom of the activated WordPress theme’s file functions.php. WordPress themes can be found in the /wp-content/themes/ directory.
remove_action('wp_head', 'wp_generator');
Hide WordPress Version Number from the RSS Feeds
To hide the WordPress version number from the default RSS feeds, add the below code at the bottom of the activated WordPress theme’s file function.php.
function remove_wp_version_rss() {
return'';
}
add_filter('the_generator','remove_wp_version_rss');
Once you update your functions.php file, refresh the page and you should not find the word generator in the page’s source.
I have added this line in functions.php, but wapplyzer can still detect the version
remove_action(‘wp_head’, ‘wp_generator’);
Hey Andy,
Please have in mind that this article is for educational purposes only.
By hiding the version of WordPress, you do not improve the security of your WordPress. It is always recommended to run the latest version of WordPress to ensure malicious hackers do not exploit known vulnerabilities and hack into your WordPress blogs and websites.
Also, note that this is hiding the version only from the generator meta tag, but the version can still be seen on other places.
Hope the above helps.
Cheers,
Rado
This is interesting. I think it is good for security so any bots scraping for vulnerable versions of WP won’t pick up the version number. Where else is it located?
Thank you for your comment Dan. As explained in the article, this is for educational purposes only. You shouldn’t hide the version of WordPress as a security measure as you will end up playing a cat and mouse game. The best way to protect your website against such threat is to keep the website up to date.
Unfortunately the WordPress version of the plugin wappalyzer is visible.
what’s the solution?
Thanks
Hello Ali,
Thanks for reaching out!
Please note that this article is for educational purposes only and by hiding the version of WordPress you do not improve the security of your website.
As mentioned in the article, keep in mind that it’s always recommended to run the latest version of WordPress to ensure malicious actors do not exploit known vulnerabilities and hack into your WordPress blogs and websites.
Regards
Did you make this settings on your own website as well?
You should check it out – it’s public.
Hey Bobby,
Thanks for letting us know.
We are aware of that and as explained in the article, this doesn’t improve the security of your WordPress website.
For more information, check the link in the article.
Regards,
no, “Hide WordPress Version Number from the RSS Feeds” code not working in newest version in wordpress
Hi Aboubaker,
We have tested the code up until WordPress version 3.8, which was released yesterday and it works. If you have any caching plugin, clear the cache and try again. Should you have any queries, just get in touch with us and will gladly assist you.