Hide My WP Ghost - Security & Firewall

WP Ghost provides request filtering, login protection and path controls, with Security Check tasks for WordPress hardening.

The free plugin includes the 2026 Ghost Firewall, Brute Force protection, 2FA and Security Check; Premium adds features such as automated IP blocking and cloud event retention.

WP Ghost lets you set login attempt limits and lockouts, add CAPTCHA, and require 2FA for selected user roles.

WP Ghost rewrites public URLs while leaving WordPress files in their existing directories.

A custom login URL reduces exposure at the default address, but WordPress still needs updates, strong authentication and backups.

WP Ghost focuses on prevention and configuration checks; use a malware scanner and a cleanup process for an existing infection.

Check which protections your host provides, then use WP Ghost for missing controls such as custom login paths or role-based 2FA.

WP Ghost can limit repeated checkout submissions and failed payment attempts from the same IP address; distributed attacks may need controls from your payment provider or host.

From version 7.0.15, WP Ghost includes checks for injection patterns, AJAX and REST requests, and malicious uploads, with comment and form checks on levels 3 and 4.

Ghost Doctor tests the homepage and asset URLs as a logged-out visitor, applies supported repairs, and reverts changes that fail its follow-up check.

Ghost Doctor starts when you click Start Diagnosis under WP Ghost > Level of Security and saves a snapshot for Undo All Changes.

AI Security Explanations turn Security Check findings into instructions for your configuration and require an active subscription with a monthly check allowance.

The request contains Security Check findings and six setup fields: server type, config writability, rewrite presence, cache plugin presence, security mode and mapped file count.

WP Ghost's local Security Check, firewall, path controls and Ghost Doctor work without using AI Security Explanations.

WP Ghost supports use alongside these security plugins; review overlapping login, firewall and URL settings, then test your site's forms.

WP Ghost path changes target system URLs rather than post permalinks, but blocked assets or crawler rules can affect search access. Run Frontend Check and verify public pages after changes.

Open WP Ghost > Level of Security and click Start Diagnosis so Ghost Doctor can test asset URLs and supported repairs.

Use the Safe URL in your saved recovery file, or rename /wp-content/plugins/hide-my-wp through FTP/SFTP to deactivate WP Ghost and restore its default login route.

WP Ghost supports Multisite and generates Nginx rewrite rules, which may need your host to apply them.

Managed hosts can restrict rewrite rules, so check your host's requirements before changing wp-admin or wp-login.php.

Add define('HMW_ALWAYS_CHANGE_PATHS', true); to wp-config.php and save your WP Ghost settings after backing up the configuration file.

WP Ghost Premium includes crawler controls, but blocking search crawlers such as PerplexityBot can limit discovery in their services. Review the selected rules before enabling AI Copyright Protection.