# How To Hide the WordPress Version With BetterShield?
Take the WordPress version out of your pages, feeds and script and stylesheet addresses, while caches still refresh after every update.
In **[BetterShield](/)**, WordPress prints its version number into every page, every feed and the addresses of many scripts and stylesheets. Scanners read it to choose what to try first. **WordPress version privacy** takes it out of all three. It is off until you turn it on, under **Hide site details** on **BetterShield › Protection › Hardening**. Quick Setup offers it as **WordPress version privacy**.
## What it does
- **Removes the generator tag** from pages and feeds, the line that names WordPress and its exact version.
- **Masks the version in asset addresses.** Where a script or stylesheet address carries the WordPress version as ?ver=, the version is replaced with a short code. The code stays the same until WordPress updates or the site's secret keys change (including through **Sign everyone out on demand**), then changes, so browsers and caches still fetch fresh files after an update. That covers WordPress's own files and any plugin or theme file registered without a version of its own, which WordPress stamps with its version.
- **Covers the sign-in page too.** WordPress would otherwise serve its files there as one combined address carrying the version, so each file is loaded on its own and masked the same way.
- **Leaves plugin and theme versions alone.** A plugin's or theme's own version on its files is not the WordPress version.
- **Writes no files,** and works on any server.
What it does not reach:
- A generator tag a theme or plugin prints for itself.
- The files every install ships, such as readme.html and license.txt. [Hide sensitive files](/docs/hide-sensitive-files/) answers them with 404.
- The version itself. In the audit's words, hiding it "does not fix an out-of-date version, it only stops announcing one."
## Step 1: Open BetterShield › Protection › Hardening
Open **BetterShield › Protection › Hardening** and find **WordPress version privacy** under **Hide site details**.
Review the state and choices shown on your own site before applying a change.
## Step 2: Hide the WordPress version
- Press **Preview the change**. It lists what applying would do and changes nothing.
- Turn the switch on. The row shows **On since** and **Undo never expires**.
It has no options, and **Monitor first** cannot watch it in advance: its panel points you back to the preview. Other ways to turn it on:
- **Findings:** **Your WordPress version is visible in your site’s code** has **Apply Fix**.
- **Quick Setup:** **WordPress version privacy**, one of the five safe fixes.
- **WP-CLI:** `wp bettershield harden version_disclosure --user=admin` applies it, `--dry-run` previews it and `--undo` reverses it. See [WP-CLI commands](/docs/wp-cli-commands/).
- **An AI assistant** allowed to make changes can apply it. Taking it off needs a plan you agree to.
The row may carry a note before you apply it:
- **Something else already filters the version tag.** Applying is still safe, because the two agree, but the version may already be hidden.
- **Another security plugin already does this with a setting of its own.** Leave the job to one of them.
## Recommended settings
Turn it on for every site. It costs nothing, and there is no reason to tell a scanner your exact version. Keep WordPress up to date as well: this hides the number, it does not change it. Updates are covered by their own finding, **A WordPress core update is available** (High).
## What it can break, and how to undo
The audit's own answer is "Could break: nothing." Two things to know:
- **Caches fetch some files once more.** The addresses of the masked files change when you apply it and again when you undo it, so browsers and caches load those files fresh one time.
- **Outside tools that read the version from your pages** stop finding it there. Check the version in your dashboard instead.
To undo, turn the switch off. The version is printed again at once, and "Hardening undone" is logged. With **Ask for my password before removing a protection** on, that asks for your password. Safe mode pauses this fix while it lasts, and deactivating BetterShield stops it.
## Final Outcome
**Findings.** **Your WordPress version is visible in your site’s code** (Low, in **Public information about your site**) closes. It checks both the page's tag and the feed's.
- **The row.** Within a few visitor page views, a line under the switch says whether WordPress's own generator still gives out the version. It also says that the page markup itself is not inspected, so a theme or plugin may still print a generator tag of its own.
- **The activity log.** "Hardening applied", and "Finding resolved" for the finding.
- **From outside.** View the source of your home page. There is no generator tag naming WordPress and its version, and addresses that carried the WordPress version as ver= now carry a ten-character code instead; core files with a version of their own, such as jQuery, keep it.
Example Hide the WordPress version view. Check the saved values and status on your own site.
## On multisite
Each site has its own switch, so apply it on every site where you want the version hidden.
## Related
- [Hardening](/docs/hardening/)
- [Hide sensitive files](/docs/hide-sensitive-files/)
- [Hide usernames](/docs/block-user-listing/)
- [Stop uploads listings](/docs/uploads-directory-listing/)
- [Score and findings](/docs/score-and-findings/)
- [WordPress hardening, fix by fix](/blog/wordpress-hardening/)
This is how you can hide the WordPress version with BetterShield.
Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).
