WP Hide PRO

Bots are not looking for you, they are looking for WordPress fingerprints

You have a site on WordPress, a theme and half a dozen plugins, and suddenly your server log fills up with attempts against wp-login.php and xmlrpc.php. It is nobody who knows you: they are bots crawling the web looking for WordPress signatures and plugins or themes with known flaws. WP Hide PRO starts from that idea: if the bot cannot see what you run, it does not know what to attack.

It does this without touching anything on the server. No files or folders are modified: it uses URL rewrite rules and WordPress filters to show paths different from the real ones.

What the outside world stops seeing with WP Hide PRO

• Masked theme: the name of the theme or child theme, the version, the author and other references are hidden.
• Plugin paths: you can change the plugins folder and the path of each plugin individually, and block the default paths.
• Your own login URL: by blocking the usual login address, bots get a cached 404 page and the server spends no resources on them.
• Clean HTML: gone are the comments left by plugins and theme and the automatic WordPress classes such as page-template-x, format-x or wp-image-x.
• AJAX calls: in the PRO version you can change the default use of run-ajax.php and block the original.
• White label: also in PRO, it replaces text in the code and assets generated by plugins and themes, including page builders such as Elementor or WPBakery Page Builder.

It also hides other typical traces, such as the REST API and XML-RPC endpoints.

Scanner, 2FA and CAPTCHA in the same plugin

It does not stop at hiding. It includes a firewall (a PRO feature) that tries to stop malicious traffic before it reaches the server. The vulnerability scan compares your installed plugins and themes with a database of known flaws and shows the matching CVE, and the general scan produces a prioritized report with recommendations.

For access, it adds two-factor authentication (2FA) and CAPTCHA with Google reCAPTCHA v2, v3 or Cloudflare Turnstile on login, registration and other forms.

Hiding a vulnerable plugin does not fix it

This is the nuance most people overlook. Hiding the fingerprint stops bots that search by name and version, but the code with the flaw is still there. Anyone who arrives by another route, or who knows your site, finds the same hole. Think of a door without a sign: it is still a door.

• The plugin handles: reducing the information theme and plugin detectors see, cutting login noise, cleaning the HTML and warning about known vulnerabilities.
• You handle: fixing or replacing the plugin or theme that has a flaw, changing weak passwords and reviewing which extensions are unnecessary.
• You handle: backups and a recovery plan in case something goes wrong.
• You handle: checking after setup that the site still works and that you saved the new login address.

Apache, Nginx, IIS and multisite: what WP Hide PRO covers

It works with Linux and Windows servers and with Apache, LiteSpeed, Nginx and IIS, using the mod_rewrite and URL Rewrite modules. Full Nginx support (LEMP stack) and multisite compatibility are PRO features. On multisite you can configure each site separately or globally from the super admin.

Since these are rewrite rules, it is wise to test in a staging environment before enabling everything in production, especially if your hosting has an unusual configuration.

Frequently asked questions

Does it hurt SEO?

It has no negative impact on SEO, and used wisely it can improve specific aspects, for example by cleaning unnecessary comments and classes out of the HTML.

Does it modify files on my server?

No. Everything is processed virtually with URL rewriting and WordPress filters, so the real folders stay where they were.

Does it make me completely invisible?

It greatly reduces what automated detectors see, but it does not replace keeping the site healthy. Afterwards, run several theme and plugin detectors against your site to check what is still visible.

Does it work on a multisite network?

Yes, it is a PRO feature: with individual settings for each site in the network or global settings from the super admin.