WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
- Installs
- 1+ million
- Rating
- 4.8 (1.5K)
- Updated
- 38 days ago
Hide My WP Ghost – Security & Firewall
Hide My WP Ghost is a WordPress security plugin that hides WP paths and protects your site with Path Security, Firewall, Brute Force Protection, 2FA
- Active installs
- 100,000+
- #401 of 1,000
- Downloads, all time
- 2.9M
- 2,937,726
- Downloads, 30 days
- 100K
- 40.7K in the last 7
- Rating
- 4.5 / 5
- 373 reviews
- Last updated
- 1 day ago
- Oct 30, 2026
- Version
- 7.0.16
- 20 releases
Upkeep and compatibility
| Last updated | October 30, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 5.8 or newer |
| Needs PHP | 7.4 or newer |
| First published | July 1, 2016 |
| Support, last two months | 3 of 5 threads resolved (60%) |
Reviews
4.5 / 5 from 373 reviews
| 5 stars | 317 |
|---|---|
| 4 stars | 5 |
| 3 stars | 8 |
| 2 stars | 9 |
| 1 star | 34 |
Downloads, last 30 days
What the author says it does
WP Ghost (formerly Hide My WP Ghost) is a WordPress security plugin focused on hack prevention that changes and secures default paths, filters requests through the Firewall, and helps block automated scanners probing default WordPress URLs.
Paths Security changes public URLs such as wp-login.php and restricts access to their default addresses. WP Ghost also includes two-factor authentication (2FA) and a Security Check with tasks for your site’s settings.
WordPress security problems WP Ghost can help with
- Repeated failed logins: set attempt limits and lockout durations under Brute Force protection.
- Bots requesting wp-login.php: use a custom login URL and block the default address.
- Visible plugin folders: change the public paths used in your site’s HTML.
- Suspicious requests: use the 2026 Ghost Firewall to filter supported attack patterns.
- Unclear security settings: run Security Check and review its prioritized tasks.
- Repeated WooCommerce payment attempts: set checkout attempt limits for each IP address.
WP Ghost focuses on attack prevention and WordPress hardening. Keep WordPress and its plugins updated, maintain backups, and use malware scanning when you need to check for infected files.
Official websites: WP Ghost and Hide My WP Ghost.
How Paths Security changes public URLs
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
What does WP Ghost do for WordPress security?
WP Ghost provides request filtering, login protection and path controls, with Security Check tasks for WordPress hardening.
Is WP Ghost a free WordPress security plugin?
The free plugin includes the 2026 Ghost Firewall, Brute Force protection, 2FA and Security Check; Premium adds features such as automated IP blocking and cloud event retention.
Can I reduce repeated WordPress login attempts?
WP Ghost lets you set login attempt limits and lockouts, add CAPTCHA, and require 2FA for selected user roles.
Can I change wp-login.php without moving WordPress files?
WP Ghost rewrites public URLs while leaving WordPress files in their existing directories.
Is hiding the WordPress login page enough to secure my site?
A custom login URL reduces exposure at the default address, but WordPress still needs updates, strong authentication and backups.
Does WP Ghost remove malware from an infected site?
WP Ghost focuses on prevention and configuration checks; use a malware scanner and a cleanup process for an existing infection.
Latest changelog entry
- Update – Whitelisted IPs are trusted across all firewall rules
- Update – Firewall path checks respect custom admin and login paths
- Update – Path settings reject weak or duplicate custom names so every path stays safe and unique
- Update – Remove Unsafe Headers moved to the Header Security section
- Update – Cleaner firewall settings layout on mobile
Screenshots
WP Ghost Overview: Choose your Level of Security to harden your site architecture. 
Admin Security: Change and secure the wp-admin path and manage access to the default URL. 
Paths Security: Customize and secure your login and registration entry points. 
Core Security: Harden your system paths (wp-content, uploads, includes) against bot reconnaissance.
Tagged
Plugins that share its tags
#51 by installs
Security Optimizer – The All-In-One Protection Plugin
Secure your WordPress site from brute-force attacks, threats, malware, and bots. Free to use and easy to set up.
- Installs
- 1+ million
- Rating
- 4.5 (157)
- Updated
- 17 days ago
#308 by installs
Anti-Malware Security and Brute-Force Firewall
This Anti-Malware scanner searches for Malware, Viruses, and other security threats and vulnerabilities on your server and it helps you fix them.
- Installs
- 100,000+
- Rating
- 4.9 (783)
- Updated
- 4 days ago
#628 by installs
WP fail2ban – Advanced Security
WP fail2ban uses fail2ban to protect your WordPress site.
- Installs
- 60,000+
- Rating
- 4.2 (71)
- Updated
- 11 days ago
#882 by installs
Security Plugin, Firewall & Malware Scanner with Auto Removal
Protect WordPress from malware, hackers, brute-force attacks & suspicious traffic. Includes firewall, login security, 2FA & vulnerability checks.
- Installs
- 40,000+
- Rating
- 4.8 (397)
- Updated
- 4 days ago
#975 by installs
XO Security
XO Security is a plugin to enhance login related security.
- Installs
- 30,000+
- Rating
- 5.0 (11)
- Updated
- 3 months ago
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin.