Remove WordPress version exposure
- Security
WordPress reveals its version number in the HTML meta generator tag, RSS feeds, and the ?ver= parameter on every script and stylesheet. Attackers use version fingerprinting to identify sites running outdated WordPress with known vulnerabilities.
<?php
/**
* Remove WordPress Version Exposure
*
* WordPress broadcasts its version number in the HTML meta tag, RSS feeds,
* and script/style query strings. Attackers use this to identify sites
* running outdated versions with known vulnerabilities. This removes the
* version from all public-facing outputs. Not a security fix by itself,
* but reduces information leakage.
*
* Usage: Add to functions.php.
*
* @category security
* @language php
*
* @author Adame Dahmani https://adame.io
* @support Support my family project: https://adame.io/fundraiser
*/
remove_action( 'wp_head', 'wp_generator' );
add_filter( 'the_generator', '__return_empty_string' );
add_filter( 'style_loader_src', function ( $src ) {
return $src ? esc_url( remove_query_arg( 'ver', $src ) ) : false;
}, 9999 );
add_filter( 'script_loader_src', function ( $src ) {
return $src ? esc_url( remove_query_arg( 'ver', $src ) ) : false;
}, 9999 );This removes the version from all public-facing outputs. It’s not a security fix on its own — always keep WordPress updated — but it reduces unnecessary information leakage.