Hide My WP (and its popular modern iteration Hide My WP Ghost) is a specialized security plugin designed for “Security through Obscurity.” Unlike standard firewalls that just block attacks, this plugin camouflages your site so hackers and bots can’t even tell you are using WordPress.
This is EXACTLY the same product as distributed by the developer. Sales Page
The core of the plugin involves rewriting WordPress URLs without physically moving files on your server.
Custom Admin Path: Change /wp-admin and wp-login.php to any custom slug (e.g., /my-secret-entry).
Path Masking: Rename common paths like /wp-content, /wp-includes, and /uploads.
Plugin & Theme Anonymization: Hide the names of the plugins and themes you are using by renaming their directory paths in the source code.
REST API & AJAX Security: Change the /wp-json path and secure admin-ajax.php to prevent data scraping.
This removes the “fingerprints” that theme detectors (like ScanWP) use to identify a WordPress site.
Meta Tag Scrubbing: Removes the generator meta tag and WordPress version numbers.
HTML Cleaning: Strips out WordPress-specific HTML comments and classes (e.g., wp-image-, wp-post-).
Header Cleanup: Removes RSD, WLW Manifest, and Shortlink headers.
Emoji & Feed Removal: Disables built-in scripts for emojis and RSS feeds that often reveal CMS info.
Next-Gen Firewall (7G/8G): Lightweight, server-edge filtering to block malicious query strings.
Brute Force Protection: Limits login attempts and hides the entry point for automated bots.
Passkey & 2FA: Support for biometric logins (FaceID/TouchID) and standard Two-Factor Authentication.
Anti-Spam: Integrated math-based reCAPTCHA for login and registration forms.
Security Headers: One-click activation for CSP, HSTS, X-Frame-Options, and X-Content-Type-Options.
| Specification | Details |
| Performance Impact | Minimal; average loading time increase is only 0.03s. |
| Server Requirements | Supports Apache, Nginx, Litespeed, and IIS. |
| Compatibility | Fully compatible with caching plugins (WP Rocket, Autoptimize) and CDNs (Cloudflare). |
| Multisite Support | Works with WordPress Multisite (sub-domains and sub-directories). |
| SEO Impact | 100% SEO friendly; it does not change permalinks for posts or pages. |
Security Levels: Choose between Safe Mode (high compatibility) and Ghost Mode (maximum invisibility).
IP Blacklisting: Manually or automatically block suspicious IP addresses and User Agents.
Event Logging: Track successful and failed login attempts and monitor user behavior.
Temporary Logins: Create secure, time-limited access links for developers without sharing passwords.
