Remove WordPress fingerprints from your RSS feed, sitemap, and robots.txt with WP Ghost. You’ve changed your wp-content, wp-includes, plugin, and theme paths. But if your sitemap still references /wp-content/uploads/, your RSS feed still contains old image paths, and your robots.txt still lists /wp-admin/, you’re leaking your WordPress identity through three files that are completely public. WP Ghost patches all three with four toggles.
What Are Feed, Sitemap, and Robots.txt?
The RSS Feed (https://yourdomain.com/feed) delivers your latest content to subscribers and feed readers. It contains post content, author names, and image URLs – all with default WordPress path structures like /wp-content/uploads/.
The Sitemap (https://yourdomain.com/sitemap.xml) lists all pages and resources for search engines to index. It includes image URLs, author pages, and structural information. SEO plugins like Yoast and Rank Math add their own styling and author metadata to the sitemap, which can further reveal your WordPress setup.
The Robots.txt file (https://yourdomain.com/robots.txt) tells search engine crawlers which paths to access and which to avoid. By default, WordPress’s robots.txt references /wp-admin/ and other WordPress-specific directories – a direct confirmation of your CMS to anyone who checks.
Why These Files Leak Your WordPress Identity
These three files are publicly accessible by design. That’s how they work – feed readers need to access your feed, Google needs to read your sitemap, and crawlers need to read robots.txt. The problem is that they contain WordPress fingerprints that undermine your other security work. Here’s why securing them matters for your hack prevention strategy:
Your RSS feed contains original image paths. Every image in your feed is referenced with its full URL. If you’ve changed /wp-content/uploads/ to a custom path on your site but your feed still uses the old paths, anyone reading the feed (including bots) can see your WordPress directory structure. The feed renders your path-hiding work invisible.
Your sitemap exposes image URLs to search engines. When Google reads your sitemap, it indexes the URLs it finds. If those URLs still contain /wp-content/uploads/ while your site uses custom paths, you get a mismatch. Google may index images under both the old and new paths, creating duplicate content. More importantly, the sitemap is publicly accessible – anyone can view it and see your full WordPress structure.
Robots.txt directly confirms WordPress. The default WordPress robots.txt contains Disallow: /wp-admin/. That single line tells every bot and scanner that you’re running WordPress. Even if you’ve hidden every other WordPress signal, a default robots.txt gives the answer away in plain text. And since robots.txt is the very first file automated scanners check, it’s often the first thing that identifies your CMS.
Feed and sitemap link tags advertise in your HTML header. WordPress adds <link> tags in your page’s <head> section pointing to the RSS feed and sitemap. These tags are visible in the page source and tell theme detectors exactly where to find your feed and sitemap for further analysis.
How to Secure Feed, Sitemap, and Robots.txt with WP Ghost
WP Ghost offers four features under the Feed & Sitemap tab. Each addresses a different file.
Hide Feed and Sitemap Link Tags
This removes the <link> tags that WordPress adds to your HTML header pointing to the RSS feed and sitemap. Scanners and theme detectors use these tags to locate your feed and sitemap for CMS identification. Hiding them removes two more WordPress signals from your page source.
- Go to WP Ghost > Tweaks > Feed & Sitemap.
- Click Save to apply.
Change Paths in RSS Feed
This replaces all default WordPress paths in your RSS feed output with your custom paths. Image URLs that reference /wp-content/uploads/ will use your custom uploads path instead. Anyone reading your feed – subscribers, bots, or aggregators – sees only the custom paths.
- Go to WP Ghost > Tweaks > Feed & Sitemap.
- Switch on Change Paths in RSS Feed.
- Click Save to apply.
Change Paths in Sitemap XML
This replaces all default WordPress image paths in your sitemap.xml with custom paths. Google and other search engines index the custom URLs instead of the default WordPress structure. This ensures your sitemap matches the paths visitors see on your site – no mismatches, no duplicate content, no WordPress fingerprints.
- Go to WP Ghost > Tweaks > Feed & Sitemap.
- Switch on Change Paths in Sitemap XML.
- Click Save to apply.
Change Paths in Robots.txt
This rewrites your robots.txt to remove all WordPress-specific paths. The default Disallow: /wp-admin/ and other WordPress references are replaced with your custom paths. The result is a clean robots.txt that meets Google’s indexing requirements without revealing your CMS.
- Go to WP Ghost > Tweaks > Feed & Sitemap.
- Switch on Change Paths in Robots.txt.
- Click Save to apply.
What Happens After You Secure These Files
Your page source loses two more WordPress signals. The feed and sitemap <link> tags are gone from the HTML header. Theme detectors that use these tags for CMS identification find nothing.
Your RSS feed shows custom paths. Subscribers and feed aggregators see images at your custom URLs instead of /wp-content/uploads/. No WordPress structure exposed through syndicated content.
Google indexes the correct URLs. Your sitemap points to custom paths that match what visitors see on your site. No mismatches. No duplicate content issues from old paths appearing in the sitemap while new paths appear on the site.
Robots.txt no longer confirms WordPress. The Disallow: /wp-admin/ line that identifies every default WordPress site is gone. Scanners checking robots.txt first (and most do) won’t find any WordPress signals.
After making changes, resubmit your sitemap in Google Search Console to accelerate re-indexing of the new paths. Also clear all caches (WordPress, CDN, server) and verify the changes by viewing your feed, sitemap, and robots.txt in a private browser window.
Troubleshooting
The sitemap still shows old paths after saving
Clear all caches: your WordPress caching plugin, your CDN (Cloudflare, BunnyCDN, etc.), and your server cache. Sitemaps are frequently cached aggressively. After clearing, visit yourdomain.com/sitemap.xml in a private browser window and check the image URLs. If your SEO plugin (Yoast, Rank Math, etc.) generates its own sitemap cache, purge that as well.
Robots.txt still shows /wp-admin/
Some hosting providers serve a static robots.txt file from the server root rather than using WordPress’s virtual robots.txt. If WP Ghost’s changes don’t appear, check whether a physical robots.txt file exists in your WordPress root directory. If it does, the server serves that file instead of WordPress’s generated version. Rename or delete the physical file and WP Ghost’s changes will take effect.
If you’ve lost access or something broke, check the emergency disable guide, use the rollback settings, or add a constant in wp-config.php to disable WP Ghost temporarily.
Frequently Asked Questions
Will this affect my SEO rankings?
No – it actually helps. By ensuring your sitemap contains the same custom URLs that visitors see on your site, you eliminate potential duplicate content issues. Google indexes the correct paths. Your feed still delivers content to subscribers normally. Your robots.txt still allows crawling of everything Google needs. The only thing that changes is that WordPress-specific path references are replaced with your custom paths.
Does this work with Yoast SEO and Rank Math sitemaps?
Yes. WP Ghost intercepts the sitemap output regardless of which plugin generates it. Whether you use WordPress’s built-in sitemap, Yoast SEO, Rank Math, or another sitemap plugin, WP Ghost replaces the paths in the output. The “Remove Plugin Authors & Style” option specifically targets the extra metadata and CSS styling that Yoast and similar plugins add to the sitemap.
Will my RSS subscribers still get updates?
Yes. The feed continues working normally – it delivers the same content with the same structure. The only change is that image URLs within the feed use your custom paths instead of default WordPress paths. Subscribers won’t notice any difference. Feed readers process the content identically.
Will changing robots.txt break Google indexing?
No. WP Ghost’s robots.txt changes maintain all the directives Google needs for proper crawling and indexing. The only difference is that WordPress-specific paths like /wp-admin/ are replaced with your custom paths. Google continues to crawl and index your public content exactly as before.
Does this work with WooCommerce?
Yes. WooCommerce product images in your feed and sitemap use the same custom paths as the rest of your media. Product feeds, category sitemaps, and robots.txt directives all reflect your custom paths. WP Ghost is fully compatible with WooCommerce.
Does WP Ghost modify these files on disk?
No. WordPress generates the RSS feed, sitemap, and robots.txt dynamically – they’re not static files (unless your host serves a physical robots.txt). WP Ghost filters the output at runtime, replacing paths before they reach the browser. No files are created, edited, or deleted. Deactivating WP Ghost restores all default paths instantly.
Related Tutorials
Complete your WordPress fingerprint removal:
- Change the Uploads Path – Set the custom paths that feed and sitemap will reference.
- Redirect Old Image Paths to New Paths – Ensure old image URLs redirect to custom ones.
- Change the wp-content Path – Replace the parent directory that feeds and sitemaps expose.
- Hide WordPress Common Paths and Files – Block access to default files and directories.
- Hide from WordPress Theme Detectors – Remove all CMS detection signals.