How To Hide the WordPress Version With BetterShield?

5 min read

Take the WordPress version out of your pages, feeds and script and stylesheet addresses, while caches still refresh after every update.

In BetterShield, WordPress prints its version number into every page, every feed and the addresses of many scripts and stylesheets. Scanners read it to choose what to try first. WordPress version privacy takes it out of all three. It is off until you turn it on, under Hide site details on BetterShield › Protection › Hardening. Quick Setup offers it as WordPress version privacy.

What it does

Removes the generator tag from pages and feeds, the line that names WordPress and its exact version.
Masks the version in asset addresses. Where a script or stylesheet address carries the WordPress version as ?ver=, the version is replaced with a short code. The code stays the same until WordPress updates or the site’s secret keys change (including through Sign everyone out on demand), then changes, so browsers and caches still fetch fresh files after an update. That covers WordPress’s own files and any plugin or theme file registered without a version of its own, which WordPress stamps with its version.
Covers the sign-in page too. WordPress would otherwise serve its files there as one combined address carrying the version, so each file is loaded on its own and masked the same way.
Leaves plugin and theme versions alone. A plugin’s or theme’s own version on its files is not the WordPress version.
Writes no files, and works on any server.

What it does not reach:

A generator tag a theme or plugin prints for itself.
The files every install ships, such as readme.html and license.txt. Hide sensitive files answers them with 404.
The version itself. In the audit’s words, hiding it “does not fix an out-of-date version, it only stops announcing one.”

Step 1: Open BetterShield › Protection › Hardening

Open BetterShield › Protection › Hardening and find WordPress version privacy under Hide site details.

Hide the WordPress version: saved state and available controls in BetterShield. — Review the state and choices shown on your own site before applying a change.

Step 2: Hide the WordPress version

Press Preview the change. It lists what applying would do and changes nothing.
Turn the switch on. The row shows On since and Undo never expires.

It has no options, and Monitor first cannot watch it in advance: its panel points you back to the preview. Other ways to turn it on:

Findings: Your WordPress version is visible in your site’s code has Apply Fix.
Quick Setup: WordPress version privacy, one of the five safe fixes.
WP-CLI: wp bettershield harden version_disclosure --user=admin applies it, --dry-run previews it and --undo reverses it. See WP-CLI commands.
An AI assistant allowed to make changes can apply it. Taking it off needs a plan you agree to.

The row may carry a note before you apply it:

Something else already filters the version tag. Applying is still safe, because the two agree, but the version may already be hidden.
Another security plugin already does this with a setting of its own. Leave the job to one of them.

Recommended settings

Turn it on for every site. It costs nothing, and there is no reason to tell a scanner your exact version. Keep WordPress up to date as well: this hides the number, it does not change it. Updates are covered by their own finding, A WordPress core update is available (High).

What it can break, and how to undo

The audit’s own answer is “Could break: nothing.” Two things to know:

Caches fetch some files once more. The addresses of the masked files change when you apply it and again when you undo it, so browsers and caches load those files fresh one time.
Outside tools that read the version from your pages stop finding it there. Check the version in your dashboard instead.

To undo, turn the switch off. The version is printed again at once, and “Hardening undone” is logged. With Ask for my password before removing a protection on, that asks for your password. Safe mode pauses this fix while it lasts, and deactivating BetterShield stops it.

Final Outcome

Findings. Your WordPress version is visible in your site’s code (Low, in Public information about your site) closes. It checks both the page’s tag and the feed’s.

The row. Within a few visitor page views, a line under the switch says whether WordPress’s own generator still gives out the version. It also says that the page markup itself is not inspected, so a theme or plugin may still print a generator tag of its own.
The activity log. “Hardening applied”, and “Finding resolved” for the finding.
From outside. View the source of your home page. There is no generator tag naming WordPress and its version, and addresses that carried the WordPress version as ver= now carry a ten-character code instead; core files with a version of their own, such as jQuery, keep it.

On multisite

Each site has its own switch, so apply it on every site where you want the version hidden.

This is how you can hide the WordPress version with BetterShield.

Getting Stuck? Feel free to contact our Dedicated Support Team.