Is it necessary to change the logout path?

It's not strictly required, but it's recommended if you're doing a complete path-hiding setup. The logout URL is another predictable wp-login.php action that reveals you're running WordPress. If you've already changed the login, register, lost password, and activation paths, leaving the logout at default creates an inconsistency that bots can detect. It takes seconds to change.

How does changing the logout path help prevent CSRF attacks?

In a CSRF attack, an attacker embeds a logout request in a malicious page or email. When a logged-in user visits that page, their session is terminated without consent. WordPress uses nonces to protect against this, but a custom logout path adds a second barrier. Attackers can't target a URL they don't know.

Does this work with WooCommerce My Account logout?

Yes. WooCommerce generates its logout links using the WordPress wp_logout_url() function, which WP Ghost hooks into. When you change the logout path, WooCommerce account page logout links automatically update to use the new custom URL.

Will users notice any difference?

No. The logout experience is identical. Users click Log Out, their session ends, and they're redirected to the login page or whichever page you've configured. The only difference is the URL in the browser address bar during the redirect, which most users never see.

What if I have hardcoded logout links in my theme or a plugin?

Any theme or plugin that uses the WordPress wp_logout_url() function will automatically use the new path. If a theme or plugin has hardcoded wp-login.php?action=logout directly in its code, that link may not update automatically. This is rare as most well-built themes use the standard WordPress function.

Does WP Ghost modify WordPress core files?

No. WP Ghost never touches, moves, or renames any WordPress file. All path changes are handled through URL rewrite rules and WordPress filters. Deactivating WP Ghost restores the default wp-login.php?action=logout path instantly.