Hide the WordPress version
Removes the version number from the page head and feeds, and from the addresses of WordPress’s own scripts and styles.
<?php
// Don't show which WordPress version runs the site.
remove_action( 'wp_head', 'wp_generator' );
add_filter( 'the_generator', '__return_empty_string' );
// Script and style addresses end in ?ver=<WordPress version>. Swap it for a
// code that still changes with each update, so browsers load the new files:
// made from the version and the time this site's WordPress files were
// installed, so it can't be turned back into the version number.
$hide_version = static function ( $src ) {
$version = get_bloginfo( 'version' );
if ( is_string( $src ) && str_contains( $src, 'ver=' . $version ) ) {
$installed = file_exists( ABSPATH . WPINC . '/version.php' ) ? (string) filemtime( ABSPATH . WPINC . '/version.php' ) : '';
$src = add_query_arg( 'ver', substr( md5( $version . '|' . $installed . '|' . home_url() ), 0, 8 ), $src );
}
return $src;
};
add_filter( 'style_loader_src', $hide_version, 9999 );
add_filter( 'script_loader_src', $hide_version, 9999 );
In these packs
- Harden WordPress: Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors.
- Clean up the head: Remove the links, scripts and styles WordPress adds to every page that most sites never use.