3

Since so many people seem to "hate" it, what is the real use of generating the wp version in the page source and adding it in the js and css files?

  • close voted as this is a question about why web standards are like they are. Obviously the use of the generator tag is not specific to wordpress and therefor the whole question is not wordpress specific. Once the standard exist web players are going to implement it. see also stackoverflow.com/questions/3632166/… – Mark Kaplun Dec 7 '15 at 4:17
  • I'm asking if there is any real benefit to the user/developer of WordPress and if yes, what it is. – IXN Dec 7 '15 at 4:24
  • the benefit is to be standard compliant? and even in that version it is still not wordpress specific – Mark Kaplun Dec 7 '15 at 4:25
5

It's use? I believe Automattic (and others) use it to generate stats on WP deployment worldwide, similar to Joomla and other CMSes.

But a lot of the reason people may 'hate' it is because of mis-education.

It is a fallacy that it is a security risk. What is a security risk is not keeping your site and plugins up to date - solve that and you don't need to be concerned about the version number displayed.

Malicious script tracking doesn't show a prevalence of version number checking before running their scripts. It is generally accepted that malicious scripts will try every previously successful exploit regardless of your WP version.

If you really want to remove your version number then see this tutorial https://premium.wpmudev.org/blog/how-to-hide-your-wordpress-version-number/ and don't forget to delete any readme files that may contain the version number.

However, my advice (as the first step in a security protocol for WP) is to spend your time implementing an auto-update process to keep your site up to date, (there are some simple scripts you can add to your functions.php to auto-update) or put in a scheduled maintenance plan to update your heavily custom sites. And learn more about WP security - goodness knows the estimated 4 million+ exploited WP sites indicates it is sorely needed.

Oh, if you are doing it for clients... don't do it for free. Educate them on why Wordpress has a maintenance/security cost to it and charge an appropriate amount for your knowledge and effort.

-1

You can also use plugin called Readme detonator. It will delete readme.html file after every update of WordPress.

  • that is a realy bad plugin, will probably not work for any reasonable permissions settings. – Mark Kaplun Jan 5 '16 at 19:16
  • I'm using it on few installations and it just work – mrfox Jan 5 '16 at 19:31
  • The fact that it works for you doesn't improve the way it is written and that it will not work for other people – Mark Kaplun Jan 5 '16 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.