Which is the best approach to hide WordPress, preferably everything from folders and files, to admin login ? I'm pretty new to that stuff, so I'll prefer a plugin ratter a custom code, unless it's easy enough to set-it up.

  • 2
    the best is not to hide Feb 16 '16 at 13:40
  • 1
    Any custom code can be turned into a plugin by putting it in a file with a comment at the top in the plugins folder, but as Mark said, this doesn't make you any more secure, and can lead to a false sense of security
    – Tom J Nowell
    Feb 16 '16 at 14:00

If you are new to php and mod_rewrite i suggest so you check with the section of my response. Or if you keen to try it yourself, you can use something like this to hide the wp-content/plugins path structure:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^modules/(.*) /wp-content/plugins/$1 [L,QSA]

This will change the path to /modules . Apply something similar to other structure, you may need some advanced rewrites, see http://httpd.apache.org/docs/current/mod/mod_rewrite.html

If prefer something out of the box, there re few interesting plugins, some commercial, also free at WordPress repository, i suggest to try WP Hide & Security Enhancer. This include lot's of things and help to change pretty much everything to make your WordPress unrecognizable. Here are some features of the code:

  • Custom admin Url
  • Block default admin Url
  • Block any direct folder access to completely hide the structure
  • Custom wp-login.php filename
  • Block default wp-login.php
  • Block default wp-signup.php
  • Adjustable theme url
  • New child theme url
  • Change theme style file name
  • Custom wp-include
  • Block default wp-include paths
  • Block defalt wp-content
  • Custom plugins urls
  • Block default plugins paths
  • New upload url
  • Block default upload urls
  • Remove wordpress version
  • Meta Generator block
  • Disble the emoji and required javascript code
  • Remove wlwmanifest Meta
  • Remove rsd_link Meta
  • Remove wpemoji
  • ...... and then you are using PHP dinosaur version, WordPress 3.old-age with crappy unsecure code in a plugin and theme, and everything you tried to hide WordPress as platform just went down the drain because you got hacked anyways just based on what I have said ;-) Feb 29 '16 at 10:30
  • doesn't sound like it hide xml-rpc, oembed,rest epi, and that is just with 1 minute thinking. This just shows how futile the whole thing is, lots of work and it still doesn't cover everything Feb 29 '16 at 10:32

Well, it depends what you mean by "hide" and what you're going to approach.

Hiding folders and files doesn't really make sense when you want to have your site acessible through the web.

You could rename your wp-login-URL, as described in this answer, which basically contains al otta reading stuff.

To prevent acessing your wp-admin folder, you could tweak your .htacces-file in the wordpress root folder.

## Disallow admin pages from external IPs
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^(xxx\.xxx\.xxx\.xxx)$
RewriteRule ^(.*)$ - [F]

Where xxx is your static IP-adress. But that won't make much sense if your ISP only gives your a dynamic IP.

  • admin is for a long time not the only way to admin a wordpress site, so "protecting" it makes sense only if you are interested in having false sense of security. Feb 16 '16 at 14:14
  • Every marathon begins with a first step. Since it isn't quite sure what @Kein D is up to (at least in my eyes), there a lot to specualate about. Maybe he just wants to setup a local WP environment? :-D
    – rob_st
    Feb 16 '16 at 14:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.