What's the point of the WP version generator?

Question

Since so many people seem to "hate" it, what is the real use of generating the wp version in the page source and adding it in the js and css files?

Answer 1

It's use? I believe Automattic (and others) use it to generate stats on WP deployment worldwide, similar to Joomla and other CMSes.

But a lot of the reason people may 'hate' it is because of mis-education.

It is a fallacy that it is a security risk. What is a security risk is not keeping your site and plugins up to date - solve that and you don't need to be concerned about the version number displayed.

Malicious script tracking doesn't show a prevalence of version number checking before running their scripts. It is generally accepted that malicious scripts will try every previously successful exploit regardless of your WP version.

If you really want to remove your version number then see this tutorial https://premium.wpmudev.org/blog/how-to-hide-your-wordpress-version-number/ and don't forget to delete any readme files that may contain the version number.

However, my advice (as the first step in a security protocol for WP) is to spend your time implementing an auto-update process to keep your site up to date, (there are some simple scripts you can add to your functions.php to auto-update) or put in a scheduled maintenance plan to update your heavily custom sites. And learn more about WP security - goodness knows the estimated 4 million+ exploited WP sites indicates it is sorely needed.

Oh, if you are doing it for clients... don't do it for free. Educate them on why Wordpress has a maintenance/security cost to it and charge an appropriate amount for your knowledge and effort.

Answer 2

You can also use plugin called Readme detonator. It will delete readme.html file after every update of WordPress.