HomeMethod

Knowledge

Web VitalsTechniquesSnippetsAnswersImpactsBottlenecks

Remove WordPress version exposure

  • Security

WordPress reveals its version number in the HTML meta generator tag, RSS feeds, and the ?ver= parameter on every script and stylesheet. Attackers use version fingerprinting to identify sites running outdated WordPress with known vulnerabilities.

remove-version-exposure.php
<?php
/**
 * Remove WordPress Version Exposure
 *
 * WordPress broadcasts its version number in the HTML meta tag, RSS feeds,
 * and script/style query strings. Attackers use this to identify sites
 * running outdated versions with known vulnerabilities. This removes the
 * version from all public-facing outputs. Not a security fix by itself,
 * but reduces information leakage.
 *
 * Usage: Add to functions.php.
 *
 * @category security
 * @language php

 *
 * @author Adame Dahmani https://adame.io
 * @support Support my family project: https://adame.io/fundraiser
 */
remove_action( 'wp_head', 'wp_generator' );

add_filter( 'the_generator', '__return_empty_string' );

add_filter( 'style_loader_src', function ( $src ) {
    return $src ? esc_url( remove_query_arg( 'ver', $src ) ) : false;
}, 9999 );

add_filter( 'script_loader_src', function ( $src ) {
    return $src ? esc_url( remove_query_arg( 'ver', $src ) ) : false;
}, 9999 );

This removes the version from all public-facing outputs. It’s not a security fix on its own — always keep WordPress updated — but it reduces unnecessary information leakage.

Support our family now