Remove the <meta name="generator"> tag that WordPress adds to every page, broadcasting your exact WordPress version to anyone who views the source. This one tag is the most direct CMS identifier in your HTML. It literally says “WordPress” and includes the version number. Bots check for it first. Theme detectors rely on it. One toggle removes it completely.
WordPress automatically adds a generator meta tag to the <head> section of every page on your site. This tag identifies your CMS and its exact version number:
<meta name="generator" content="WordPress 6.7.1" />It’s not just WordPress. Several plugins add their own generator tags too. WooCommerce adds <meta name="generator" content="WooCommerce 9.5.1" />. Some themes add generator tags. The result? Your page source can contain multiple generator tags, each revealing a different piece of your software stack.
These tags serve no functional purpose for visitors or search engines. They exist purely as CMS identification metadata. WP Ghost’s Hide WordPress Generator META Tags feature removes all of them.
The generator tag is the single most explicit WordPress fingerprint in your page source. Here’s why hiding it matters for your hack prevention strategy:
It tells attackers your exact WordPress version. “WordPress 6.7.1” is not ambiguous. An attacker reads the tag, checks the WPScan vulnerability database for that version, and knows exactly which exploits apply. No scanning required, no guessing needed. The information is handed to them in plain text.
It confirms WordPress to every scanner. The word “WordPress” in the generator tag is the primary signal tools like Wappalyzer, BuiltWith, and theme detectors use to identify your CMS. Even if you’ve hidden every path, changed every directory, and removed every other fingerprint – this one tag overrides it all. It’s the first thing scanners check and the most reliable CMS indicator in the HTML.
Plugin generator tags expose your stack. WooCommerce, Yoast, and other plugins add their own generator tags with version numbers. A page with three generator tags reveals WordPress, WooCommerce, and your SEO plugin – with exact versions of each. That’s three entries in the vulnerability database to cross-reference.
It provides zero value. The generator tag doesn’t affect SEO. Search engines don’t use it for ranking. Visitors never see it. It exists only as a metadata marker. Removing it costs nothing and eliminates the most visible CMS identifier on your site.
After saving, open your site in a private browser window and view the page source. Search for generator – no results should appear. The WordPress generator tag, along with any plugin generator tags, is removed from the HTML output.
For complete version hiding: The generator tag is just one place where version numbers appear. WordPress also adds ?ver= parameters to CSS and JavaScript URLs. For a thorough cleanup, also enable Hide Version from Images, CSS, and JS to strip version parameters from all frontend assets.
Yes. WP Ghost removes all generator meta tags from the HTML output, not just the WordPress core one. WooCommerce, Yoast, and any other plugin that adds a generator tag will have theirs removed too.
This feature targets the <meta name="generator"> tag specifically. The Hide WordPress Version feature strips ?ver= parameters from CSS, JavaScript, and image URLs. They address different locations where version information leaks. For maximum protection, enable both.
No. Search engines don’t use the generator meta tag for indexing or ranking. Google’s crawlers ignore it entirely. Your content, sitemaps, canonical URLs, and structured data remain unchanged.
WordPress adds generator information to RSS feeds as well. For complete feed security including path changes and generator removal, also enable the features in the Feed, Sitemap, and Robots.txt tutorial.
No. WP Ghost removes the generator tag from the HTML output at runtime using WordPress filters. No files are modified. Disabling the feature instantly restores the generator tag.
Remove all version and identity fingerprints:
Replace the default wp_ database prefix with a random one to protect against SQL injection…
Change the WordPress uploads directory path with WP Ghost (rewrite rules, no files moved) or…
Configure WP Ghost with WP Rocket cache. Enable file optimization, Change Paths in Cache Files.…
https://youtu.be/6ylhojSi-_E In this video, we’ll explore why website security matters and what can happen if…
The security of your WordPress site depends on multiple factors, such as the strength of…
Step-by-step guides to connect WP Ghost 2FA with Google Authenticator, Authy, Microsoft Authenticator, or LastPass.…