Myth-Busting SOP: 'Hiding the WordPress Version Stops Attacks'

Myth-Busting SOP: 'Hiding the WordPress Version Stops Attacks'

Stripping the generator meta tag feels productive. Attackers fingerprint via readme, asset hashes, and REST routes regardless — and they spray exploits blind anyway. Spend the effort right:

— Step 1: Remove the version tag if you like tidy headers, but log it as cosmetic.
— Step 2: Patch fast — version-spray bots don't read your meta tag, they just fire CVEs at every host.
— Step 3: Restrict /wp-json/wp/v2/users so the REST API doesn't enumerate accounts.
— Step 4: Block direct access to readme.html and license.txt.
— Step 5: Verify with wpscan — if it still detects your version, you've proven hiding is theater.

Fingerprint-hiding wastes time better spent patching. Run this every time.