I noticed WP adding long query strings to my CSS and JS files. Not just the version parameter from wp_enqueue_style from a Theme or something, no something fishy going on. I even switched to the 2016 theme to be sure and even there:



What is this and where does it come from? I am not using WP's debug mode, nor using any caching plugins or something..


When disabling plugins I traced the issue.
Apparently it's the WordFence plugin.

This query string is from the option "Hide WordPress version" -- it replaces the original "ver=" string that already appears on the static content. If you uncheck that box, you will see the original version numbers instead, without any changes from Wordfence.

It shouldn't affect any pageload scores, since it is only replacing a version string that already exists, but may affect browser caching if you need query strings to change to cause an asset to expire. In an upcoming version of Wordfence, this part of the query string will only be replaced if the "ver=" string matches the WordPress version, so it will not hide the original version string of other assets.

  • 1
    It is amazing how useless all those "security" plugins are. The attackers care about figuring your version before attacking as much as spammers are trying to figure out if you have sexual problems before sending a viagra spam do you. – Mark Kaplun Mar 14 '16 at 6:57
  • 1
    On second thought, this kind of version string will expose that you are running wordfence and might provoke the attacker to try something specific against it (and it is not like the security plugins are immune from security problems) – Mark Kaplun Mar 14 '16 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.