Hide WordPress Version: How to Remove It (and Why Updating Matters More)

Back in 2007, I was chatting with several WordPress bloggers who were putting off a security upgrade because, they said, nobody knew which version they were running. I told them everyone knows your WordPress version: it’s printed right in the page source. That’s still true. Here’s how to hide WordPress version details in 2026, and why it’s only a small part of keeping your site safe.

Quick answer: Add remove_action('wp_head', 'wp_generator'); and add_filter('the_generator', '__return_empty_string'); to your theme’s functions.php (or a code snippets plugin) to remove the version from your page head and RSS feeds. Many security plugins do this with one checkbox. The best protection, though, is keeping WordPress, themes and plugins updated.

Where WordPress shows its version

• The generator meta tag in your page’s HTML head.
• Your RSS feeds (generator tag).
• ?ver= query strings on core scripts and stylesheets.
• The readme.html file in your WordPress root folder.

How to hide WordPress version numbers

1. Remove the generator tag and feed version

remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

2. Remove version numbers from scripts and styles

function qot_remove_ver($src) {
  if (strpos($src, 'ver=' . get_bloginfo('version'))) {
    $src = remove_query_arg('ver', $src);
  }
  return $src;
}
add_filter('style_loader_src', 'qot_remove_ver', 9999);
add_filter('script_loader_src', 'qot_remove_ver', 9999);

This only strips the core version; plugin versions remain, which helps caching.

3. Block readme.html

Delete readme.html after each update, or block it in .htaccess. Some security plugins handle this.

4. Use a security plugin

Wordfence, Solid Security and similar plugins can hide the version along with other hardening options.

Why updating matters more

Hiding your version is security through obscurity. Automated attack tools usually try known exploits on every site regardless of version. What actually protects you:

• Turn on automatic updates for WordPress core and trusted plugins.
• Remove unused themes and plugins.
• Use strong passwords and two-factor authentication.
• Keep regular off-site backups.

Google has long warned site owners running old versions; see Google warns bloggers hosting old WordPress versions. Locked out? Here’s the emergency WordPress password reset script.

FAQ

Is hiding the WordPress version worth it?

It’s a quick extra step but won’t stop attacks on its own. Updating is far more important.

Will hiding the version break my site?

No. The generator tag isn’t needed for anything to work.

Can people still tell my site uses WordPress?

Yes, from folder names like /wp-content/. Hiding the version only hides which release you use.