# Hide the WordPress version without breaking caches

Remove the WordPress version from pages, feeds and script addresses, see what it does and does not change, and why caches still refresh after every update.

By M Asif Rahman, Oct 31, 2026. Updated Nov 2, 2026.

To hide the WordPress version, take the number out of the three places WordPress prints it: the generator tag in your pages and feeds, and the `?ver=` part of script and stylesheet addresses. BetterShield’s **WordPress version privacy** does all three in one switch, and it masks the number in a way that lets browsers and caches fetch fresh files after every update.

Our guide to [WordPress hardening, fix by fix](/blog/wordpress-hardening/) lists every one-click fix. This post takes this one on its own, because the usual advice about it is a snippet in a theme file that removes one tag and leaves the rest.

## Quick summary

- **WordPress version privacy** removes the version from pages, feeds and the addresses of scripts and stylesheets.
- It is off until you turn it on, and **Preview the change** shows what it will do first.
- The number in asset addresses is replaced by a short code that changes when WordPress updates, so caches still refresh.
- It does not fix an out-of-date version. It only stops announcing one.
- Turn the switch off to undo it. The version is printed again at once.

## Why the version number matters

WordPress prints its exact version into every page, every feed and the addresses of many scripts and stylesheets. Nothing in that is a mistake. It is how WordPress has always worked.

The reason to remove it is small and practical. Scanners read the number to choose what to try first, so a site that states its version saves them the guessing. Hiding it does not make the site safer by itself, which is the honest limit of this fix. It simply stops handing out a detail that nobody needs, in the same spirit as the idea behind [security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity): useful as one layer, never as the only one.

## What it does

- **Removes the generator tag** from pages and feeds. That is the line that names WordPress and its exact version. WordPress prints it with [the_generator()](https://developer.wordpress.org/reference/functions/the_generator/).
- **Masks the version in asset addresses.** Where a script or stylesheet address carries the WordPress version as `?ver=`, the version is replaced with a short code.
- **Covers the sign-in page too.** WordPress would otherwise serve its files there as one combined address carrying the version, so each file is loaded on its own and masked the same way.
- **Leaves plugin and theme versions alone.** A plugin’s or theme’s own version on its files is not the WordPress version.
- **Writes no files,** and works on any server.

### Why caches still refresh

This is the part a hand-made snippet usually gets wrong. If you strip `?ver=` from every address, a browser or a cache can keep an old file after an update, because nothing in the address changed.

BetterShield replaces the version with a short code instead. The code stays the same until WordPress updates or the site’s secret keys change, including through **Sign everyone out on demand**. Then it changes, so browsers and caches fetch fresh files. That covers WordPress’s own files and any plugin or theme file registered without a version of its own, which WordPress stamps with its version.

## What it does not reach

| Still visible | Why |
|---|---|
| A generator tag a theme or plugin prints for itself | The fix covers WordPress’s own generator, not a tag added by something else. |
| The files every install ships, such as readme.html and license.txt | [Hide sensitive files](/docs/hide-sensitive-files/) answers them with 404. |
| The version itself | In the audit’s words, hiding it “does not fix an out-of-date version, it only stops announcing one.” |
| Core files with a version of their own, such as jQuery | They keep the version they ship with. |

## Set it up

1. Open **BetterShield › Protection › Hardening** and find **WordPress version privacy**.
2. Press **Preview the change**. It lists what applying would do and changes nothing.
3. Turn the switch on. The row shows **On since** and the date.

The fix has no options, and **Monitor first** cannot watch it in advance: its panel points you back to the preview. There are other ways to turn it on:

- **Findings:** **Your WordPress version is visible in your site’s code** has **Apply Fix**.
- **Quick Setup:** **WordPress version privacy** is one of its safe fixes.
- **WP-CLI:** `wp bettershield harden version_disclosure --user=admin` applies it, `--dry-run` previews it and `--undo` reverses it. See [WP-CLI commands](/docs/wp-cli-commands/).
- **An AI assistant** that you have allowed to make changes can apply it. Taking it off needs a plan you agree to.

The row may carry a note before you apply it. **Something else already filters the version tag** means applying is still safe, because the two agree, but the version may already be hidden. **Another security plugin already does this with a setting of its own** means you should leave the job to one of them.

## What it can break, and how to undo

The audit’s own answer is “Could break: nothing.” Two things are worth knowing:

- **Caches fetch some files once more.** The addresses of the masked files change when you apply it and again when you undo it, so browsers and caches load those files fresh one time.
- **Outside tools that read the version from your pages** stop finding it there. Check the version in your dashboard instead.

To undo, turn the switch off. The version is printed again at once, and “Hardening undone” is written to the [activity log](/docs/activity-log/). With **Ask for my password before removing a protection** on, that asks for your password. Safe mode pauses this fix while it lasts, and deactivating BetterShield stops it.

## Check it is working

- **Findings.** **Your WordPress version is visible in your site’s code** (Low, in **Public information about your site**) closes. It checks both the page’s tag and the feed’s.
- **The row.** Within a few visitor page views, a line under the switch says whether WordPress’s own generator still gives out the version. It also says that the page markup itself is not inspected, so a theme or plugin may still print a generator tag of its own.
- **The activity log.** It records “Hardening applied”, and “Finding resolved” for the finding.
- **From outside.** View the source of your home page. There is no generator tag naming WordPress and its version, and addresses that carried the WordPress version as `ver=` now carry a ten-character code instead.

## Recommended settings

We recommend turning it on for every site. It costs nothing, and there is no reason to tell a scanner your exact version. Keep WordPress up to date as well, because this hides the number and does not change it. Updates have their own finding, **A WordPress core update is available** (High), and the [score and findings](/docs/score-and-findings/) doc explains how it is rated.

On multisite, each site has its own switch, so apply it on every site where you want the version hidden.

It sits beside two related fixes that close other small leaks. [Hide usernames](/docs/block-user-listing/) stops the user list being read, and our post on [WordPress user enumeration](/blog/wordpress-user-enumeration/) explains why that matters. Together they take away the details a scanner would otherwise collect for free. The [Hardening](/docs/hardening/) overview shows the whole set.

## Frequently asked questions

### Does hiding the WordPress version make my site secure?

No. It stops the site announcing its version, and that is all. An out-of-date WordPress is still out of date, so keep updating. BetterShield reports a pending core update as its own finding.

### Will hiding the version stop browsers loading new files after an update?

No. The version in asset addresses is replaced by a short code, not removed. The code changes when WordPress updates or the site’s secret keys change, so browsers and caches fetch fresh files.

### Why does my page still show a generator tag?

A theme or plugin can print a generator tag of its own, and this fix covers WordPress’s generator only. The row under the switch says that the page markup itself is not inspected, so view the source to see what remains.

### What happens to caches when I turn it on?

Browsers and caches load the masked files fresh one time after you apply or undo it, then carry on as normal. After a WordPress update the short code changes, so those files are fetched again.

### How do I turn it off?

Turn the switch off on the same row. The version is printed again at once, and the change is logged.

## Conclusion

Hiding the version is a small, quiet fix. It removes the number from pages, feeds and asset addresses, keeps caches refreshing, and can be undone with one switch. It does not replace updating WordPress. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/); the full details are in the [Hide the WordPress version doc](/docs/hide-wordpress-version/).