Bots can't break a door they can't find
Every bot attack starts the same way
It runs a checklist. /wp-login.php, /wp-admin/, /xmlrpc.php, your plugin folder, the REST API user endpoint. One of them answering is all it takes to confirm a WordPress site and start the real attack. Which is why moving one path isn’t enough.
01
Automated scanners don't research your site. They run a fixed list of WordPress paths against millions of domains an hour, looking for anything that responds.
02
Your login, admin, plugin, theme and API paths get new URLs. Nothing in WordPress core is modified - it works through rewrite rules and filters, and reverses instantly on deactivation.
03
Every default path returns 404. The 8G firewall blocks what's left at the server edge, before PHP even starts. The bot logs a dead site and leaves.
| Exposed by default | After WP Ghost |
|---|---|
| /wp-login.php | /custom-login |
| /wp-admin/ | /backstage/ |
| /wp-content/plugins/ | /assets/modules/ |
| /wp-content/themes/ | /assets/styles/ |
| /wp-json/wp/v2/users | 404 — not found |
| /xmlrpc.php | 404 — not found |
You choose the replacement paths. These are examples.
Measured, not claimed
Numbers from sites running WP Ghost in 2026 with cloud reporting enabled. The real figure is higher; anything blocked at the server edge never reaches the counter.
Seven layers, one plugin
WP Ghost- Security Threats
- User Events
- Settings
| Threat Type ↕ | Location ↕ | Details | Status ↕ | Date ↕ |
|---|---|---|---|---|
| Probing for vulnerable code | Country: 🇩🇪 Germany IP: 85.214.132.44 | Path: /.env Method: GET |
Prevented | 2 hours ago |
| Brute force login attempt | Country: 🇧🇷 Brazil IP: 177.100.43.89 | Path: /wp-login.php Method: POST |
Prevented | 5 hours ago |
| Attempt to access prohibited URL | Country: 🇸🇬 Singapore IP: 116.14.82.12 | Path: /wp-content/debug.log Method: GET |
Prevented | 1 day ago |
| Malicious bot blocked | Country: 🇺🇸 United States IP: 45.33.22.115 | Path: /xmlrpc.php Method: POST |
Prevented | 2 days ago |
| Probing for vulnerable code | Country: 🇨🇦 Canada IP: 142.250.180.14 | Path: /wp-config.php.bak Method: GET |
Prevented | 3 days ago |
Every default WordPress path is a known fingerprint for automated attacks. WP Ghost neutralizes this threat through robust Path Security, changing your routes to custom, secured URLs using server rewrite rules and native hooks. It’s structural protection with zero risk: no core files are edited, nothing is moved on disk, and deactivating the plugin restores every default path instantly.
Changes paths safely using server rewrite rules. Zero File Risk: No core edits, no physical files moved. Instant Rollback: Deactivate to restore defaults instantly. Proven Reliable: Tested against 1,000+ plugins, including WooCommerce and Elementor.
Secures predictable vulnerabilities against automated attacks. Asset Protection: Secures wp-content, uploads, and endpoints like the REST API. Instant 404s: Drops a hard 404 on unauthenticated visitors trying to hit wp-admin or login pages.
7G & 8G
Firewall
Stop malicious traffic before it even loads. This server-edge firewall uses robust Apache or Nginx rewrite rules to block SQL injections, XSS, and directory traversal vulnerabilities before WordPress or PHP can even process the request.
The result? Maximum structural security with zero database queries and zero performance impact.
Passwordless
Login & 2FA
Bulletproof your authentication without sacrificing user experience. Features unlimited 2FA (Authenticator apps, Email, and biometrics like Face ID, Touch ID, and Windows Hello), plus Magic Link passwordless entry.
Secure your workflow with time-limited Temporary Logins for contractors, trusted-device skipping, and strict brute-force reCAPTCHA protection across all login, registration, and WooCommerce forms.
Ghost Doctor
Self-Repair
Never worry about a broken site. If your server ignores your rewrite rules, Ghost Doctor acts as an anonymous visitor to diagnose and auto-repair the routing.
Every fix is live-tested and instantly reverted if unsuccessful. Built with absolute fail-safes, it physically cannot lock you out of your admin path.
Premium users get plain-language AI diagnostics and clear action steps customized to their exact server architecture.
One-Click Security Presets
Deploy advanced Path Security instantly. Choose from Lite, Safe Mode, or Ghost Mode to automatically configure your entire routing architecture.
Safe Mode (the Premium default) is rigorously optimized for complex tech stacks, while Ghost Mode aggressively hardens your installation by securing extensions and locking down highly targeted files like wp-config.php and readme.html.
Auto IP Blocking & Full Logs
Turn data into active defense. Automatically block repeat offenders based on custom threshold rules you control. Gain total visibility with a comprehensive Security & User Events Log, featuring advanced filters, full-text search, a live GEO threat map, real-time email alerts, and 30-day cloud storage with seamless CSV exporting.
Country & AI Crawler Blocking
Take absolute control over who—and what—can access your paths. Geo-block specific countries site-wide, exclusively on login pages, or per custom path (with easy IP allowlisting for your team).
This same firewall actively intercepts GPTBot, ClaudeBot, and 30+ other AI web crawlers, protecting your content and bandwidth with dynamically updated robots.txt rules in every release.
Plus one-click database prefix change, SALT regeneration, file permission fixes and 14 WordPress footprint removal features.
What changed after installing it
Since I installed the plugin, it has stopped all the brute force attacks on my site, which is a total win. I do not have to worry about my account data or my customers' info being hacked.
Owner, Marketing & Advertising
Verified review on Capterra
WP Ghost now provides my site with better security than before due to the extra features such as hiding plugin names, theme names and even the WordPress operating system. It is a must-have for anyone serious about security.
IT Professional
Verified review on G2
I like the combination of features and options available with WP Ghost. It works alongside other well-known security plugins. Pricing was important, makes a big difference when you manage 100+ sites.
Creative Director, Design Agency
Verified review on Capterra
A scanner cleans up after the break-in
While scanners are essential for detecting malware, WP Ghost provides active structural defense to prevent the breach in the first place. WP Ghost is engineered to run flawlessly alongside Wordfence, Sucuri, Solid Security, and Cloudflare.
| Malware scanners | WP Ghost | |
|---|---|---|
| When it acts | After files are already on your server | Before the request reaches WordPress |
| What it does | Detects and removes infections | Hides the entry points bots target |
| Server load | Periodic full-site scans | Blocks at the edge, zero DB queries |
| Result of success | A clean site after an incident | Zero incident to clean up |
| Run them together? | Yes, proactive prevention + reactive detection is the ultimate security stack. | |
One plan. Every premium feature.
No feature tiers, no add-ons. Pick the number of sites you need, everything else is included. 30-day money-back guarantee on all plans.
Renews yearly. Cancel anytime, no renewal price increases.
Ghost 1
Best for: freelancers, personal blogs
- 1 Website
- All premium features included
- Paddle Secure Payment
20% OFF
65% OFF
Most Popular
Ghost 5
Best for: small businesses, devs
- 5 Website
- All premium features included
- Paddle Secure Payment
70% OFF
Ghost All
Best for : WordPress agencies
- 1000 Website
- All premium features included
- Paddle Secure Payment
30-day refund, no questions asked · Secure payment via Paddle · Cancel anytime, no hidden fees · Upgrade later, settings preserved
Want to try it first? The free version on WordPress.org includes 115+ features
70% OFF
Ghost 5 LTD
Best for: agencies
- 5 Website
- All premium features included
- Paddle Secure Payment
70% OFF
Ghost 10 LTD
Best for: agencies
- 10 Website
- All premium features included
- Paddle Secure Payment
70% OFF
Ghost 1000 LTD
Best for: agencies
- 1000 Website
- All premium features included
- Paddle Secure Payment
The questions people actually ask
Will changing paths break my site?
No. WP Ghost is engineered for zero-risk compatibility. It never edits WordPress core files or moves physical files on your disk. Instead, it securely routes traffic using virtual server rewrite rules and native hooks. If you ever need to revert, simply deactivating the plugin restores your default paths instantly.
Our Safe Mode (Premium) is rigorously stress-tested against 1,000+ plugins and theme, including WooCommerce, Elementor, and Divi. It integrates flawlessly alongside existing security tools like Wordfence, Cloudflare, and Sucuri across Apache, Nginx, LiteSpeed, and multisite environments.
What is Ghost Doctor, and why does it matter?
It’s an automated self-repair engine for your site’s routing. If your server ignores a path rewrite (a common issue with strict host configurations), Ghost Doctor steps in. It scans your site like an anonymous visitor to identify failures, applies targeted repairs, live-tests the fix, and automatically keeps it if successful, or instantly reverts it if not.
Built with absolute safety in mind, it is physically barred from altering your admin or login paths, meaning it can never lock you out. (Included in every Free and Premium plan)
What if I lock myself out?
You have multiple fail-safes to ensure you never lose access. Before any structural changes go live, our Setup Wizard confirms your new login URL and emails it directly to you. You also have backup entry methods: Magic Links and Temporary Logins offer alternative ways in, while a dedicated Safe URL parameter restores access instantly if a path stops responding.
In the absolute worst-case scenario, restoring your site to default paths takes just a single, simple configuration change that our support team can guide you through.
What is the difference between Lite, Safe Mode and Ghost Mode?
Lite Mode (Free): Secures core endpoints like
wp-login.php,wp-content,uploads, and the REST API. It leaveswp-adminandadmin-ajax.phpat their defaults to guarantee out-of-the-box compatibility with virtually any setup.Safe Mode (Premium): The recommended default for WooCommerce, LMS, and membership sites. It actively secures
wp-adminandadmin-ajax.phpusing advanced rewrite techniques, and activates automated IP blocking, Country blocking, AI crawler blocking, and the Event Log.Ghost Mode (Premium): The maximum-hardening preset. Includes everything in Safe Mode, plus aggressive structural defenses like file extension securing (removing predictable
.phpor.jsontrails) and deep WordPress fingerprint removal. (Note: Because this is highly aggressive, we recommend testing your stack after activation.)
I am on Nginx. Does this still work?
Yes, flawlessly. Because Nginx doesn’t read .htaccess files, rewrite rules simply need to be added to your server configuration once. WP Ghost generates the exact code you need, and Ghost Doctor automatically detects your Nginx setup to provide a step-by-step guide. If your host restricts server config edits entirely, WP Ghost automatically falls back to robust protections that don’t require rewrites, ensuring your firewall, brute-force protection, 2FA, and fingerprint removal remain actively engaged.
Will it slow my site down?
Not at all. WP Ghost operates with zero database queries. Because the 7G/8G firewall and path security run as Apache or Nginx rewrite rules, malicious traffic is blocked at the server edge, before WordPress or PHP is even invoked.
You get enterprise-grade structural security without scanning overhead. Most users see absolutely zero impact on their Core Web Vitals.
Isn't this just security through obscurity?
No, it’s active structural defense. Obscurity is only a weakness if it’s your only defense. With WP Ghost, path security is just layer one of seven. By changing your predictable architecture, you instantly remove your site from automated attack maps.
Bots don’t investigate; they blindly hammer a fixed list of default paths across millions of domains. When WP Ghost serves them a hard 404 at those entry points, their scripts fail and they move on. Combine this structural change with our edge firewall, 2FA, and automated IP blocking, and you get a defense system proven to drop bot attacks by up to 90%.
I already use Wordfence or Sucuri. Do I need this?
Yes, because they do entirely different jobs. Security scanners are reactive, they find and clean malicious files after they are already on your server. WP Ghost is proactive, it secures your architecture at the server edge to prevent the breach from happening in the first place.
Layering your defense (proactive prevention + reactive detection) is the ultimate security stack, and WP Ghost is officially compatible with all major scanners.
How long does setup take?
Under two minutes. Install it like any standard plugin, run the quick Setup Wizard, and select a security preset.
You can even use our Frontend Test to verify your new secure paths before applying them. It requires no coding, no server access, and absolutely zero technical knowledge to lock down your site.
What's the refund policy?
30 days, full refund, no questions asked. Email support and it’s processed. Subscriptions renew annually through Paddle and can be cancelled anytime from your dashboard.
Can I block specific countries?
Yes (Premium). You can easily block specific countries directly at the firewall level. Choose to enforce geo-blocking across your entire site, strictly on your login pages, or on specific custom paths.
You can also permanently allowlist your team’s IPs, ensuring you never accidentally lock yourself out while traveling.
Does it block AI crawlers like GPTBot?
Yes, in Premium. WP Ghost blocks 30+ AI crawlers including GPTBot, ClaudeBot and CCBot at the firewall level, and adds matching Disallow rules to robots.txt. The crawler list is updated with every plugin release, so you aren’t maintaining it yourself.
What's actually in the free version?
115+ features: Lite Mode path security, the full 7G and 8G firewall, brute force protection with reCAPTCHA on all login forms, all three 2FA methods including passkeys, Magic Link passwordless login, Temporary Logins, security headers, 14 WordPress footprint removal features, the Security Optimization Score, GEO threat map, weekly monitoring email, the last 20 threat and user events, and the whole of Ghost Doctor. It’s a real protection layer, not a trial.
Premium adds Safe Mode and Ghost Mode, wp-admin and admin-ajax path changes, file extension hiding, automated IP blocking with configurable rules, country blocking, AI crawler blocking, the full Threats and User Events log with filters, full-text search and CSV export, 30-day cloud log storage, real-time email alerts, AI explanations for every security finding, one-click database hardening (prefix change, SALT regeneration, file permissions) and priority support. Upgrading installs over the free plugin, every setting, path and configuration is preserved, with no downtime.
Every second, a bot is scanning for default paths
One plan. Every premium feature.
A professional cleanup runs $300–$1,000 and costs you rankings for months. Prevention starts at $23.99 a year, with 30 days to change your mind