Hide the WordPress Version Number
Removes the WordPress version number from your site's HTML, RSS feeds, and asset URLs, so automated scanners can't instantly tell which security patches you're missing.
- Difficulty
- Beginner
- Reading time
- ~1 min
- Where to add it
- A small custom plugin
- Last updated
The Problem
By default, WordPress prints its exact version number in a `<meta name="generator">` tag in every page's `<head>`, in every RSS feed, and as a `?ver=X.X.X` query string on nearly every enqueued script and stylesheet. None of that is a vulnerability by itself, but it's a free reconnaissance shortcut for anyone running automated vulnerability scanners: knowing the exact core version instantly tells an attacker which known, publicly-documented core vulnerabilities might still be unpatched on your install, without them needing to guess or probe further. Removing that fingerprint doesn't fix any underlying vulnerability, but it does mean opportunistic, script-driven attacks — which make up the overwhelming majority of WordPress attacks — have to work harder to even know if you're worth targeting.
The Code
// Remove the version number from <meta name="generator">.
remove_action( 'wp_head', 'wp_generator' );
// Strip WordPress's ?ver=X.X.X query string from enqueued scripts and styles.
add_filter( 'style_loader_src', 'devmubs_remove_wp_version_strings' );
add_filter( 'script_loader_src', 'devmubs_remove_wp_version_strings' );
function devmubs_remove_wp_version_strings( $src ) {
global $wp_version;
if ( strpos( $src, 'ver=' . $wp_version ) ) {
$src = remove_query_arg( 'ver', $src );
}
return $src;
}
// Remove the WordPress version from the RSS feed generator tag.
add_filter( 'the_generator', '__return_empty_string' );How It Works
The first line unhooks `wp_generator`, the function core uses to print the `<meta name="generator">` tag, from the `wp_head` action — since it's removed from the hook entirely, nothing replaces it, and the tag simply doesn't render. The two `add_filter` calls target `style_loader_src` and `script_loader_src`, the filters WordPress runs on every enqueued stylesheet and script URL right before output; the shared callback checks whether the current WordPress version number appears in the `?ver=` query string and, if so, strips that query argument entirely using `remove_query_arg()` — leaving the asset URL working exactly the same, just without the version fingerprint. The last line targets `the_generator`, the equivalent output used in RSS/Atom feeds, replacing it with an empty string so feed readers and scrapers don't see the version there either.
Where To Add This
A small custom plugin. None of this depends on which theme is active — it's the same three filters regardless — so it belongs in a small plugin that keeps working even if the theme changes later, rather than in a specific theme's functions.php.
Warnings & Caveats
- This is a defense-in-depth measure, not a substitute for actually keeping WordPress core, plugins, and themes updated — hiding the version number does nothing against a targeted attacker willing to fingerprint your site by other means (readme.html files, specific plugin behavior, etc.).
- Always back up your site before adding custom code.