The wp-content directory is one of the most recognizable WordPress paths and a primary target for automated attacks. Changing its URL prevents bots from finding and targeting your plugins, themes, and uploads directories. WP Ghost changes the wp-content path through rewrite rules (no files moved), or you can change it at the WordPress level using wp-config.php constants (physical directory rename required). WP Ghost’s approach is recommended because it’s reversible and doesn’t modify core files.
Automated bots scan for /wp-content/ to identify WordPress sites and locate plugins, themes, and uploaded files. Once they find wp-content, they probe for known vulnerabilities in specific plugins and themes. Changing this path to a custom name (like /lib/ or /assets/) makes your site unrecognizable to these automated scans. This is a core part of WP Ghost’s hack prevention strategy: if bots can’t find the doors, they can’t try to break them.
WP Ghost changes the wp-content path through URL rewrite rules without physically moving any files or directories. This is the safest approach because deactivating WP Ghost instantly restores original paths with no cleanup needed.
lib).Your site now serves content from the custom path (for example, yourdomain.com/lib/) instead of yourdomain.com/wp-content/. The physical directory on the server remains wp-content. WP Ghost handles the mapping through rewrite rules.
No files are moved. WP Ghost uses rewrite rules to map the custom URL path to the original wp-content directory. If you deactivate WP Ghost, all paths revert to their defaults immediately. You don’t need to move plugins, themes, or uploads back.
You can change the wp-content directory at the WordPress level using constants in wp-config.php. This method physically renames the directory and is permanent until you reverse it manually.
wp-config.php via FTP, File Manager, or SSH.lib with your custom name and yourdomain.com with your actual domain):define('WP_CONTENT_DIR', __DIR__ . '/lib');
define('WP_CONTENT_URL', 'https://yourdomain.com/lib');
define('UPLOADS', 'lib/uploads'); wp-content folder to lib (or your chosen name) using File Manager or FTP.Method 2 is harder to reverse. This approach physically renames the directory and changes WordPress constants. To revert, you need to rename the directory back to wp-content and remove the constants from wp-config.php. Some plugins may store absolute paths in the database, which can cause issues after reverting. Method 1 (WP Ghost) is recommended because it’s fully reversible with no file changes.
Method 1 (WP Ghost) is recommended for most users. It changes the URL path without moving files, is instantly reversible, and works alongside WP Ghost’s other security features. Method 2 (code) is for advanced users who want a WordPress-level change independent of WP Ghost.
No. If you’ve already changed the wp-content directory using Method 2, WP Ghost’s path field should reflect the current directory name, not wp-content. Using both methods simultaneously creates conflicting path mappings.
Yes. WP Ghost can change both wp-content and wp-includes paths through the same Change Paths interface. The code approach (Method 2) only supports changing wp-content. WordPress doesn’t provide constants for changing wp-includes.
No. WP Ghost uses rewrite rules and WordPress hooks to map custom paths to original directories. No files or directories are physically renamed. Deactivating WP Ghost restores all defaults instantly.
Path security and WordPress identity protection:
Replace the default wp_ database prefix with a random one to protect against SQL injection…
Change the WordPress uploads directory path with WP Ghost (rewrite rules, no files moved) or…
Configure WP Ghost with WP Rocket cache. Enable file optimization, Change Paths in Cache Files.…
https://youtu.be/6ylhojSi-_E In this video, we’ll explore why website security matters and what can happen if…
The security of your WordPress site depends on multiple factors, such as the strength of…
Step-by-step guides to connect WP Ghost 2FA with Google Authenticator, Authy, Microsoft Authenticator, or LastPass.…