# Hide WordPress and PHP Versions on All Your Sites

Source: https://srvscripts.com/guides/hide-wordpress-php-version/
Updated: 2026-10-22
Publisher: srvScripts (https://srvscripts.com/)

Every WordPress site tells the world which WordPress version it runs, and many also announce the PHP version, unless you switch that off. Automated scanners read those numbers to pick exploits for your exact release. This guide hides both on every site on a server: a small must-use plugin for WordPress, two lines of web server config for PHP and the server banner, and a script to roll it out.

**Short answer:** put a must-use plugin in `wp-content/mu-plugins/` that empties the generator, block `readme.html`, `license.txt` and `wp-links-opml.php`, set `expose_php = Off` for every PHP version on the server, and shorten the `Server` header. Then check with `curl` or our [WordPress Security Check](/tools/wordpress-security-check/). Hiding versions is cheap hygiene; it does not replace updating.

**Scope and evidence:** the must-use plugin and the `.htaccess` block were tested on 22 October 2026 on our lab site (WordPress 7.1.1, Apache with PHP-FPM, DirectAdmin 1.712, AlmaLinux 9); the results are in the table below. `expose_php = Off` was already the DirectAdmin CustomBuild default there. The cPanel, CloudLinux, LiteSpeed and nginx steps follow the vendor documentation and were not run on a production server for this guide. The bulk script was tested against throwaway accounts (results in the rollout section), not on a production server: run it with `DRY=1` first and test one site.

In short: Empty the WordPress generator with a must-use plugin, block readme.html, license.txt and wp-links-opml.php, set expose_php = Off for every PHP version and shorten the Server header. Then keep updating.

## What gives your versions away

| Where | What a visitor sees | Fix |
| --- | --- | --- |
| Home page  | WordPress 7.1.1 | Must-use plugin |
| RSS and Atom feeds (/feed/) | https://wordpress.org/?v=7.1.1 | Must-use plugin |
| /wp-links-opml.php | generator="WordPress/7.1.1" | Must-use plugin and block the file |
| ?ver= on core CSS and JS, including the login page | style.min.css?ver=7.1.1 | Must-use plugin (hash instead of the version) |
| /readme.html, /license.txt | Confirms WordPress; old releases also showed the version | Block the files (updates put them back if you delete them) |
| X-Powered-By response header | PHP/8.3.20 | expose_php = Off |
| Server response header | Apache/2.4.62 (AlmaLinux), nginx/1.26.2 | ServerTokens / Server Signature / server_tokens |

Lab result on 22 October 2026, before and after the must-use plugin and the `.htaccess` block:

| Check | Before | After |
| --- | --- | --- |
| Generator tag on the home page | WordPress 7.1.1 | gone |
| Feed generator | ?v=7.1.1 | gone |
| wp-links-opml.php | 200, WordPress/7.1.1 | 403 |
| ?ver=7.1.1 on the home page / login page | 2 / 11 times | 0 / 0 |
| readme.html, license.txt | 200 | 403 |
| Home page and login page | 200 | 200 |
| WordPress Security Check | WordPress 7.1.1 (latest 7.1.3) | actual version hidden · estimated 7.1.1, 7.1.2 from public core files |

The last row matters: hiding stops the easy reads, but an outside check can still estimate a release by comparing public core files such as `block-library/style.min.css` with WordPress.org checksums. Changing those files would break updates, so do not try. Keeping WordPress current is what actually protects you.

## Hide the WordPress version with a must-use plugin

Save this as `wp-content/mu-plugins/hide-wp-version.php` (create the `mu-plugins` folder if it does not exist). Must-use plugins load automatically, cannot be switched off from the dashboard and survive theme changes.

```