Protect your website by concealing vulnerable WordPress traces, plugins, themes, login/admin url. 2FA, Captcha, Firewall, Security Headers etc.
| Last updated | September 23, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 4.0 or newer |
| Needs PHP | 5.4 or newer |
| First published | December 9, 2015 |
| Support, last two months | 3 of 3 threads resolved (100%) |
4.3 / 5 from 275 reviews
| 5 stars | 219 |
|---|---|
| 4 stars | 7 |
| 3 stars | 9 |
| 2 stars | 5 |
| 1 star | 35 |
Effortlessly conceal your WordPress site from detection! With over 99.99% of hacks targeting specific plugin and theme vulnerabilities, this plugin significantly boosts site security by making it invisible to hackers’ web scanners.
By removing all traces of WordPress, including themes and plugins, potential exploits are rendered harmless. This method ensures that your site is safe without affecting SEO; in fact, it can enhance certain SEO aspects when used strategically.
WP-Hide has launched the easiest way to completely hide your WordPress core files, login page, theme and plugins paths from being shown on front side. This is a huge improvement over Site Security, since no one will know whether you are running or not a WordPress. It also provides a simple way to clean up html by removing all WordPress fingerprints.
No file and directory change!
No file and directory will be changed anywhere. Everything is processed virtually. The plugin code uses URL rewrite techniques and WordPress filters to apply all internal functionality and features. Everything is done automatically without user intervention required at all.
Real hide of WordPress core files and plugins
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Under the hood, this plugin never writes to, deletes, or modifies any existing files or directories on your server. Instead, it leverages WordPress’s built-in hook system and virtual URL rewrite rules—applied in memory—to seamlessly redirect and mask asset links. Rest assured, your core files, themes, and plugins remain exactly as you left them, with zero risk of unintended changes.
Yes—100% beginner-friendly.
You don’t need to write a single line of PHP to customize or manage this plugin. Every feature is controlled via a clear, intuitive admin panel with descriptive labels, tooltips, and contextual help. Whether you want to hide common WordPress paths, rename your wp-content folder, or inject security headers, each option can be toggled on or off with a simple click.
Yes, you can check out a live demo at https://demo.wp-hide.com/. Additionally, you can visit our official website, WP Hide and Security Enhancer, for more information.
Free Version: Does not auto generate native Nginx rewrite directives. However, you can still run it behind an Nginx reverse proxy or on hybrid setups (e.g., Apache + Nginx). However, it is fully compatible with Apache, LiteSpeed, IIS, and Nginx when used as a reverse proxy.
For Nginx conside WP Hide PRO.
Yes, updates remain effortless.
Our plugin is designed to play nicely with the WordPress update process. You can upgrade your core, themes, and all other plugins through the dashboard or via WP-CLI without disabling WP Hide. All rewrite rules and filters persist through updates, so there’s no downtime or extra steps required.
Not in the slightest.
We only rewrite the paths to static assets (CSS, JS, images) and administrative URLs—your publicly visible content URLs (posts, pages, categories) remain unchanged. Search engines will continue to index your site normally, and any existing sitemaps or canonical tags will work exactly as before.
#882 by installs
Protect WordPress from malware, hackers, brute-force attacks & suspicious traffic. Includes firewall, login security, 2FA & vulnerability checks.
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team. Make security a priority with Wordfence.
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
#46 by installs
Loginizer is a WordPress security plugin which helps you fight against bruteforce attacks.
#51 by installs
Secure your WordPress site from brute-force attacks, threats, malware, and bots. Free to use and easy to set up.
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin. The author takes donations at their donate page.
