View the source of any WordPress site and you will often find a small giveaway near the top: <meta name="generator" content="WordPress 6.x" />. That line tells the world exactly which WordPress version you run – and attackers use version numbers to match sites against known vulnerabilities. Hiding it will not make you invincible, but it removes a free piece of reconnaissance and it takes about two minutes. In this guide you will learn how to remove the WordPress version number from your site’s head section, RSS feeds, and script/style URLs using three safe methods.
Where Does WordPress Expose Your Version Number?
WordPress leaks its version in three places. First, the generator meta tag in your HTML head. Second, your RSS feeds, which include a generator line. Third, the version query strings on CSS and JavaScript files (like style.css?ver=6.8). A complete job covers all three – removing only the meta tag while leaving ?ver= strings everywhere is like locking the front door and leaving the windows open.
Method 1: Remove the Version with a Code Snippet (Recommended)
This is the cleanest approach: a few lines of code, no new plugin to maintain. Add it via the Code Snippets plugin or a child theme’s functions.php – never edit a parent theme’s files directly, since updates will wipe your changes. The snippet uses the remove_action and the_generator hooks documented in the official WordPress developer reference, so you can verify exactly what each line does.
// Remove version from head meta tag
remove_action( 'wp_head', 'wp_generator' );
// Remove version from RSS feeds
add_filter( 'the_generator', '__return_empty_string' );
// Remove version query strings from scripts and styles
function vtg_remove_version_strings( $src ) {
if ( strpos( $src, 'ver=' ) ) {
$src = remove_query_arg( 'ver', $src );
}
return $src;
}
add_filter( 'script_loader_src', 'vtg_remove_version_strings', 9999 );
add_filter( 'style_loader_src', 'vtg_remove_version_strings', 9999 );After saving, view your page source and search for “generator” – the meta tag should be gone – and check that your CSS/JS URLs no longer carry ?ver= parameters. Note one trade-off: removing version strings can interfere with browser caching when you update files, since browsers use those strings to know when a file changed. For most small sites this is harmless, but it is worth knowing.
Method 2: Hide It with a Security Plugin
If you prefer not to touch code, security plugins like Wordfence, Sucuri, or All In One WP Security include a “hide version number” option in their settings. Install the plugin, find the hardening or “hide WordPress version” setting, and enable it. This is the easiest route for beginners, and you get a firewall and malware scanning as a bonus. The downside is adding a whole plugin for a job a four-line snippet does – on a site already running lean, the snippet wins. Our guide on limiting login attempts without a plugin follows the same philosophy: code first, plugin only when the code gets complicated.
Method 3: Remove It Server-Side (Advanced)
On Apache servers you can strip version exposure at the server level, but for most site owners this is overkill. Method 1 covers everything the server-level approach does for the version number specifically. Mentioning it only so you know the option exists if you ever harden a server manually.
Does Hiding Your Version Actually Improve Security?
Honestly: a little, but not much. This is “security through obscurity” – it stops casual scanners and automated bots that filter targets by version, but a determined attacker has other ways to fingerprint your site. The measures that truly matter are the boring ones: keep WordPress, themes, and plugins updated, use strong passwords, and limit login attempts. Think of hiding the version as closing the curtains: sensible, cheap, but not a substitute for a locked door. Pair it with the fundamentals in our guide to disabling XML-RPC, another small hardening step that closes a real attack vector.
What to Check After Removing the Version
- View page source and confirm the
generatormeta tag is gone. - Open
yoursite.com/feed/and confirm no WordPress version appears. - Check that your site still loads normally – broken caching or a typo in the snippet are the usual culprits if something looks off.
- Keep updating WordPress itself. Hiding the version is not an excuse to skip updates; an outdated hidden version is still an outdated vulnerable version.
And remember that real security starts with the foundation: a host that patches servers promptly and offers free SSL. Our web hosting guide explains what to demand from a host before you trust it with your site.
Five More Small Hardening Steps Worth Doing
Hiding the version number is one layer. These five take a few minutes each and matter more:
- Delete the “admin” username. If your login username is still “admin”, create a new administrator account with a unique name, log in as the new user, and delete the old “admin” account (assigning its posts to the new one). Half of brute-force attacks target the username “admin” specifically.
- Limit login attempts. WordPress lets anyone try unlimited password guesses by default. Our guide on limiting login attempts without a plugin shows the code approach step by step.
- Keep a fresh backup. Security is also about recovery: a hacked site with a yesterday backup is an inconvenience, not a disaster. Our database backup guide covers the no-plugin method.
- Close XML-RPC if you do not need it. The
xmlrpc.phpfile is a classic brute-force and DDoS vector that most modern sites never use. Our guide to disabling XML-RPC explains how to turn it off safely.
Do these five plus the version hiding in this post, and your site is harder to crack than the vast majority of WordPress installations – all without installing a single security plugin. None of them need ongoing maintenance either, which is exactly why small, permanent hardening steps beat elaborate security routines that get abandoned after a month.
Frequently Asked Questions
How do I remove the WordPress version number from my site?
Add a small snippet to remove the generator meta tag, filter the RSS generator output, and strip version query strings from scripts and styles. Alternatively, enable the “hide version” option in a security plugin like Wordfence or Sucuri.
Is it safe to remove the WordPress version number?
Yes. The snippet above is widely used and does not break WordPress functionality. The only minor trade-off is that removing ?ver= strings can affect browser caching of updated CSS/JS files on some setups.
Does hiding the WordPress version stop hackers?
Not by itself. It removes one piece of reconnaissance that automated bots use, but real protection comes from updates, strong passwords, limited login attempts, and a good host. Treat version hiding as one layer, not the whole defense.
Where is the WordPress version number visible?
In three places: the generator meta tag in your HTML head (view page source to see it), your RSS feeds, and the ?ver= query strings appended to CSS and JavaScript file URLs.
Last updated: October 2026.
