Hide My WP WordPress Plugin
Antivirus scan
Powered by ClamAV
✅ Verified clean
This product file has passed our security filters.
Want to run a fresh ClamAV scan right now? Takes a few seconds and shows scanner version, signature DB and live result.
This can take 5 to 30 seconds.
Clean file Threat detected
No threats detected in this file.
- File
- Size
- Scanned
- ClamAV
- Signature database
⚡ Powered by ClamAV
Scan could not be completed
Report product
If you detected an issue (broken file, malware, inappropriate content, etc.) let us know and we'll review it ASAP.
Sign in to report
About Hide My WP WordPress Plugin
For people who want to stay under the radar of bots, not for those expecting a code patch
A WordPress site with default paths is easy to spot: bots crawl thousands of sites looking for /wp-login.php, /wp-admin/ or well-known plugin folders, and they do it even if nobody cares about your site. Hide My WP changes those addresses so the crawl finds nothing where it expected to.
It suits people who run their own business or client websites and want fewer login attempts and fewer snoopers, and anyone who doesn't want a theme detector to reveal what their site is built with. It doesn't suit those who believe hiding is the same as repairing: if an installed plugin has a flaw, it keeps that flaw even if it is harder to see. It is also not for those who mix different web servers (that combination is not officially covered) or who need Multisite on Nginx or IIS, which is in the author's plans but doesn't exist yet.
Hide My WP doesn't move files: it controls who gets to them
The plugin doesn't modify any file or folder. Everything stays in its default location and what changes is access and the shape of the URLs. That reduces clashes with themes and plugins, but it means the plugin needs to be able to write rules on the server. If the .htaccess file isn't available, manual rules can be applied.
Login, admin and author: the doors bots try first
- wp-login.php stops responding: you only get in with the key you define.
- wp-admin is renamed (for example to /my-admin/) or hidden from unauthorized users.
- Author and feeds: you can change the author profile address or disable it, and the same goes for feeds.
- Classic queries: URLs like ?p=, ?author= or ?s= stop working and are replaced by others you choose.
- Giveaway files: readme.html and license.txt return page not found, and you can also disable archives by date, categories or tags.
What a theme detector sees when it scans your site with Hide My WP
The plugin changes the theme folder, removes its information from the stylesheet, replaces default WordPress classes and minifies the result. It does something similar with plugins: it changes their directory and turns their names into codes. It also renames uploads, wp-includes and the AJAX URL.
You can also replace any word in the HTML output, remove WordPress meta information from the header and feeds, clean up menu and body classes, compress the HTML without comments, change the sender of WordPress emails and set up your own 404 page. It includes specific options against online detectors and can hide Elementor and WP Rocket. After activating it, review the public side of your site carefully: renaming paths is a deep change.
Intrusion detection and whitelist: who can manage your WordPress
The built-in intrusion detection system looks for XSS, SQL injection and command injection attacks, and can work in alert mode. If someone is snooping around your site, it notifies you with their IP, user agent, referrer and even the username. There is a list of blocked IPs with the option to whitelist or delete them, allow only certain countries and restrict administration to the IPs you specify.
Be careful with that restriction: if your IP changes, you can lock yourself out. For those cases the plugin offers a reset link that deactivates it. Save it before locking anything down.
Questions before hiding WordPress with Hide My WP
Does it replace a full security plugin?
No. It hides paths and filters the attack types mentioned, but it doesn't fix flaws in other plugins or replace backups.
Can it break my theme or plugins?
Since it doesn't move files, compatibility is usually high. Even so, if something has hand-written paths, or you use caching, check that everything loads after the change.
Does it work on Multisite?
It does have options for Multisite, but on Nginx and IIS it is not available yet.
How do I check it is no longer visible?
Open the old paths, such as wp-login.php: they should return page not found. You can see it working in the demo.
Topics
Version history
-
v
6.2.12 Current 7 Sep 2026
-
v
6.2.11 8 Jan 2025
Customer reviews
Sign in to leave a review. Only people who have the product can review it.
No reviews for this product yet.
Frequently asked questions
-
GPL (General Public License) is the license under which WordPress and most premium plugins/themes are distributed. It grants you the right to use, modify and redistribute the software in as many projects as you want, with no domain restrictions.
-
Yes. With membership you get automatic updates via our GPLClub Updater plugin (installed on your WP, detects new versions and applies them). With individual purchase, you get one year of manual updates from your account.
-
Depends on the plan. Monthly: 3 domains. Semi-annual: 7. Annual and Lifetime: 15. Individual purchase: 1 domain.
-
GPLClub offers its own support for installation, configuration and compatibility. For direct support from the original author (feature requests, product-specific bugs), a license purchased from the author is required.
