WP Ghost Premium is a professional WordPress plugin focused on hiding WordPress fingerprints and firewall hardening. By disguising site fingerprints, it prevents automated scanners from identifying that your website is built on WordPress, thereby significantly reducing the risk of vulnerability probing and brute-force attacks. As a commercial security plugin, WP Ghost Premium achieves deep protection through URL rewriting and rule configuration without moving server files, making it an essential tool for site administrators who prioritize security operations.

WP Ghost Premium Core Principle: Only Rewrite URLs, Don't Move Files

WP Ghost Premium works in a remarkably clever way: it only rewrites URL output without physically moving server files. Through URL rewriting rules, it modifies front-end output paths, hiding characteristic URLs such as wp-content, wp-includes, and wp-admin from the source code; the actual files remain unchanged in their server disk locations, and everything immediately reverts to normal once the plugin is deactivated.

Apache environments rely on the .htaccess file; Nginx users must manually import the plugin-generated hidemywp.conf and reload the Nginx service, otherwise the path disguise functionality cannot be fully enabled. It is recommended to back up server settings before configuration.

WP Ghost Premium Advanced Features Detailed

1. WordPress Fingerprint Disguise (Core Capability)

  • Modify the admin login URL, customize access paths for wp-admin and wp-login.php, and block the default login entry point.
  • Virtual rewriting: wp-content, wp-includes, plugins, themes, and uploads are all changed to custom random URLs, making original paths invisible in front-end source code.
  • Ghost Mode (Pro exclusive): One-click activation of maximum disguise, hiding PHP extensions and core files to erase WordPress traces to the greatest extent; in production environments, it is recommended to enable with caution and prioritize using Safe Mode compatibility mode.
  • Text Mapping: Replace wordpress and wp- related text strings in source code to confuse scanning crawlers.
  • Automatically handle sitemap.xml and robots.txt rewriting without affecting search engine indexing.

2. Firewall and Attack Protection

  • Built-in 7G/8G Firewall, defending against SQL injection, XSS, script injection, directory traversal, and other common request attacks.
  • Brute-force protection: login endpoint rate limiting, automatic banning of repeatedly attacking IPs (Pro automatic IP banning), support for reCAPTCHA v2/v3 and math captcha.
  • XML-RPC protection: restrict or disable xmlrpc.php, block RPC brute-force attacks, with on-demand toggle compatible with WP App/Jetpack.
  • 2FA two-factor authentication, Passkey login, and magic link passwordless login.
  • Geo Country Blocking (Pro): Block the entire site or specific paths by country IP, commonly used by international trade sites, allowing access only from target business countries.
  • AI Crawler Blocking (Pro): Block 30+ AI training crawlers such as GPTBot and ClaudeBot at the firewall level, without interfering with Google/Bing search engine crawling.

3. Logging, Alerts, and Operations Enhancement (Pro)

  • Complete security threat logs and user activity logs, supporting CSV export, with 30-day cloud log retention for convenient auditing and troubleshooting.
  • Real-time email alerts: email notifications triggered by brute-force attacks and abnormal access.
  • Temporary login accounts: generate time-limited administrator accounts without sharing passwords, for use by contractors and technical support.
  • Database hardening: one-click regeneration of WP SALT keys, modification of database table prefixes, file permission verification, hardening of wp-config.php, and blocking debug.log leaks.
  • Custom login page design, modify login page styles and logo.

4. Compatibility

  • Supports WordPress Multisite, with network-wide configuration enablement.
  • Officially confirmed compatible with WPML, WooCommerce, Elementor, and various caching plugins (WP-Rocket, W3TC, WP Fastest Cache).
  • Servers: Apache, LiteSpeed, Nginx (requires manual configuration), IIS.

If you are looking for more similar WordPress security plugins, you can visit bobohello.com resource site for related recommendations.

For official documentation and detailed configuration instructions, please refer to: WP Ghost Official Website.

Frequently Asked Questions

How to install WP Ghost Premium?

In the WordPress admin panel, go to "Plugins" -> "Add New", upload the WP Ghost Premium ZIP installation package, and complete the basic configuration following the wizard after activation. Nginx servers require additionally importing the generated configuration file and reloading the service. For details, please refer to the official documentation.

What scenarios is WP Ghost Premium suitable for?

It is suitable for websites that need to hide WordPress fingerprints and defend against automated attacks, especially international trade sites, corporate websites, and e-commerce sites. It also works for multilingual sites (such as WPML) and multisite networks.

Is WP Ghost Premium compatible with caching plugins?

It is officially confirmed to be compatible with mainstream caching plugins such as WP-Rocket, W3TC, and WP Fastest Cache, as well as WooCommerce, Elementor, and WPML. It is recommended to verify in a testing environment before use.

How often is WP Ghost Premium updated?

As a commercial plugin, WP Ghost Premium regularly releases security updates and feature improvements. It is recommended to enable automatic updates or follow official announcements to get the latest version.

Does WP Ghost Premium support Nginx servers?

Yes, but you need to manually import the plugin-generated hidemywp.conf file and reload the Nginx service. If you do not have Nginx configuration permissions, some path disguise features may not be fully enabled.

Disclaimer: All articles on this site, such as no special instructions or labeling, are the site's original release. Any individual or organization, without the consent of this site, prohibit copying, stealing, collecting, publishing the content of this site to any website, books and other types of media platforms. If the content of this site violates the legal rights and interests of the original author, you can contact us to deal with.