Hide My WP Ghost - Security & Firewall

No. WP Ghost uses high-performance server rewrite rules (Nginx, Apache, IIS) to change visible paths in your source code. Your actual WordPress files and directories stay exactly where they are, ensuring no risk to your site’s stability or core updates.

For most WordPress sites, yes. By combining Architectural Hardening with an 8G Firewall and Automated IP Blocking, WP Ghost neutralizes automated reconnaissance and brute-force attempts that account for over 90% of real-world attacks. It provides a foundational defense often sufficient on its own, while remaining fully compatible with “Defense in Depth” strategies involving malware scanners or file-integrity monitors.

Security scanners tell you what is wrong. AI Security Explanations tell you what it means for your website. WP Ghost sends your findings for analysis along with a short description of your site setup: server type, whether rewrite rules are active, if your config file is writable, and your security mode. It returns a plain-language explanation for each finding, one clear action to take, and a priority order based on what genuinely exposes your site. Open Details on any finding to read the reasoning behind it. Read more on wpghost.com.

Only the findings already on your Security Check page and a small description of your configuration are sent: server type, whether the config file is writable, whether rules are present, if a cache plugin is installed, your security mode, and a count of mapped files. No page content, user data, passwords, or database contents are ever sent. The feature is entirely opt-in; nothing is transmitted until you press the button.

Completely. The Security Check scan, 0-100 score, prioritized list, severity bands, every task detail, and the entire Ghost Doctor diagnosis and repair process run on your server and need no connection. AI Security Explanations only add wording on top. Using them requires a connected WP Ghost account with an active subscription and a monthly allowance of checks. The page shows exactly how many you have left. = Is it compatible with other WordPress security plugins? =Yes. WP Ghost is designed as your “Outer Perimeter” defense. It works perfectly alongside malware scanners and reactive security tools like Wordfence, Sucuri, or Solid Security. By implementing Paths Security first, WP Ghost stops bots before they get close enough to be scanned by other plugins..

Not at all. WP Ghost handles Sitemap.xml and Robots.txt mapping automatically. This ensures Google and other search engines can index your content perfectly, while malicious bots receive a 404 error when probing your system paths.

Obscurity is simply hiding a key under a mat. Paths Security is an architectural hardening strategy like moving the door to a secure, unique location and changing the lock. It is a recognized technical hardening standard used by enterprise-grade sites to prevent Bot Reconnaissance.

Yes. The plugin is fully compatible with WP Multisite (Network-wide configuration) and supports Apache, Nginx, IIS, and LiteSpeed servers.

WP Ghost fully supports Nginx. Because Nginx does not use .htaccess, you will be guided to add the generated rewrite rules manually to your nginx.conf file. We provide specific tutorials for Kinsta, RunCloud, CloudPanel, CWP7, AAPanel, and Ploi.io.

This usually happens when the server rewrite rules are not yet active.

• Purge Cache: Clear your WordPress cache and any server-side caching (Varnish, Nginx FastCGI).
• Manual Rewrites: If your server config file is not writable, copy the rules from WP Ghost and add them manually to your .htaccess or nginx.conf.
• Restart Nginx: If on Nginx, you must reload/restart the service after saving settings.
• Free Support: If the issue persists, contact us and we will set up the plugin for you for free.

• Safe URL: Use the “Safe URL” text file automatically generated and downloaded when you saved your settings.
• Manual Reset: Access your server via FTP/SFTP and rename the folder /wp-content/plugins/hide-my-wp to something else. This temporarily disables the path changes so you can login via the default wp-login.php.

Due to the restricted infrastructure of WordPress.com managed hosting, changes to the administrative and login paths are not allowed. However, you can still use WP Ghost for Site Hardening, the 8G Firewall, Passkey Authentication, and other Hack Prevention features.

Yes. The Lite version of WP Ghost will always be free and includes essential WordPress Security updates. To unlock advanced features like IP Block Automation, Geo-Security, and Cloud Monitoring, you can upgrade to WP Ghost Premium.

By using Paths Security to change common directories (plugins, themes, wp-content), you effectively neutralize most automated detectors. For a deep-dive on total anonymity, read our guide: How to Hide Your Site From WordPress Theme Detectors.

WP Ghost provides an elite proactive defense by neutralizing the Reconnaissance phase of an attack. While the Free version blocks the vast majority of bot traffic, we recommend the Premium version for advanced Brute Force Protection and Automated Threat Intelligence.

By default, WP Ghost only changes paths on the frontend to ensure maximum compatibility. To harden the admin dashboard as well, add define('HMW_ALWAYS_CHANGE_PATHS', true); to your wp-config.php file and re-save your settings.

Yes. WP Ghost 7.0 includes a Security Optimization Score from 0 to 100 that shows exactly how hardened your site is. The score updates automatically as you enable features and complete security tasks. It appears on the Overview dashboard and the Security Check page as both a visual gauge and a numeric value.

Yes. WP Ghost includes a Login Page Designer that lets you add your custom logo, background image, and brand colors to your secured login page. It includes 12 layout presets and 10 color scheme presets. The designer works with your custom login URL, so your branded page is served at your hidden path instead of the default wp-login.php.

WP Ghost Premium includes an AI Copyright Protection feature that blocks 30+ AI training crawlers including GPTBot, ClaudeBot, PerplexityBot, CCBot, and Bytespider at the firewall level. It also adds Disallow rules to your robots.txt automatically. This protects your copyrighted content from being used for AI model training without affecting your regular Google, Bing, or Yahoo search visibility. The crawler list is automatically updated with each plugin release.