For security reasons I don't want it to be obvious that I use Word Press. I use the W3 Total Cache plugin and minify HTML, CSS and JS. I may also use a CDN.

Is it possible to modify the W3 Total Cache plugin so that it can rewrite the Wordpress directories "wp-content", "wp-admin" and "wp-includes" without actually renaming these directories? I'd ideally like to be able to rewrite W3 Total Cache directories such as "w3tc"

  • 4
    If hiding the fact that you are running on WordPress would have made your site secure, don't you think this would have been a feature in WordPress? If the only reason you want to hide that your site is running on WordPress is securing it then don't bother. Maybe other people actually have solution for this, but for me its not worth it. Aug 9, 2011 at 13:49
  • I wouldn't have posted this if I didn't feel this was a good idea. I completely understand if you don't think it's worth it, but that doesn't exactly help me! WordPress itself is very secure, but if my site is screaming out that it is powered by Wordpress then it could be vulnerable to an attack before a bug fix has been released and is reliant on me upgrading straight away.
    – baritoneuk
    Aug 9, 2011 at 14:09

2 Answers 2


This was covered extensively in Steps to Take to Hide the Fact a Site is Using WordPress.

The answer in that question covered renaming the wp-content and the plugin directory. If you prefer rewriting those directories you can use these functions found in the Roots WordPress theme to rewrite the directories relative to your sites root directory.

if (stristr($_SERVER['SERVER_SOFTWARE'], 'apache') !== false) {
    function roots_htaccess_writable() {
        if (!is_writable(get_home_path() . '.htaccess')) {
            add_action('admin_notices', create_function('', "echo '<div class=\"error\"><p>" . sprintf(__('Please make sure your <a href="%s">.htaccess</a> file is writeable ', 'roots'), admin_url('options-permalink.php')) . "</p></div>';"));

    add_action('admin_init', 'roots_htaccess_writable');

    // Rewrites DO NOT happen for child themes
    // rewrite /wp-content/themes/roots/css/ to /css/
    // rewrite /wp-content/themes/roots/js/  to /js/
    // rewrite /wp-content/themes/roots/img/ to /js/
    // rewrite /wp-content/plugins/ to /plugins/

    function roots_flush_rewrites() {
        global $wp_rewrite;

    function roots_add_rewrites($content) {
        $theme_name = next(explode('/themes/', get_stylesheet_directory()));
        global $wp_rewrite;
        $roots_new_non_wp_rules = array(
            'css/(.*)'      => 'wp-content/themes/'. $theme_name . '/css/$1',
            'js/(.*)'       => 'wp-content/themes/'. $theme_name . '/js/$1',
            'img/(.*)'      => 'wp-content/themes/'. $theme_name . '/img/$1',
            'plugins/(.*)'  => 'wp-content/plugins/$1'
        $wp_rewrite->non_wp_rules += $roots_new_non_wp_rules;

    add_action('admin_init', 'roots_flush_rewrites');

    function roots_clean_assets($content) {
        $theme_name = next(explode('/themes/', $content));
        $current_path = '/wp-content/themes/' . $theme_name;
        $new_path = '';
        $content = str_replace($current_path, $new_path, $content);
        return $content;

    function roots_clean_plugins($content) {
        $current_path = '/wp-content/plugins';
        $new_path = '/plugins';
        $content = str_replace($current_path, $new_path, $content);
        return $content;

    // only use clean urls if the theme isn't a child or an MU (Network) install
    if (!is_multisite() && !is_child_theme()) {
        add_action('generate_rewrite_rules', 'roots_add_rewrites');
        if (!is_admin()) { 
            add_filter('plugins_url', 'roots_clean_plugins');
            add_filter('bloginfo', 'roots_clean_assets');
            add_filter('stylesheet_directory_uri', 'roots_clean_assets');
            add_filter('template_directory_uri', 'roots_clean_assets');

    function roots_add_h5bp_htaccess($rules) {
        global $wp_filesystem;

        if (!defined('FS_METHOD')) define('FS_METHOD', 'direct');
        if (is_null($wp_filesystem)) WP_Filesystem(array(), ABSPATH);

        if (!defined('WP_CONTENT_DIR'))
        define('WP_CONTENT_DIR', ABSPATH . 'wp-content');   

        $theme_name = next(explode('/themes/', get_template_directory()));
        $filename = WP_CONTENT_DIR . '/themes/' . $theme_name . '/inc/h5bp-htaccess';

        $rules .= $wp_filesystem->get_contents($filename);

        return $rules;

    add_action('mod_rewrite_rules', 'roots_add_h5bp_htaccess');


You will also need to make sure and remove the W3 Total Cache X-Powered-by headers .

<IfModule mod_headers.c>
         Header set X-Powered-By "W3 Total Cache/"

If your going to use a CDN W3 Total Cache will use the same path structure:


So you will either need to rewrite these using .htaccess on the CDN if you have access or not use minify.

  • Thanks for this very helpful answer. I had just discovered the Roots theme and it's amazing in what it does. Unfortunately I do really want everything minified, and W3 Total Cache undoes all the great work that the Roots theme does. Do you think it will be possible to rewrite the urls ? For example, myblog.com/wp-content/w3tc/min/6a6a912d.dcd8f1.css ?
    – baritoneuk
    Aug 10, 2011 at 13:53
  • Thanks for your help here, this pretty much answers my question. If you can give me any tips on how to get W3 Total Cache to play ball I'd be very happy!
    – baritoneuk
    Aug 10, 2011 at 15:26

Hiding WordPress is possible but takes a lot of effort and is problematic with updates. Also it is the wrong solution, a better option would be to actually secure WordPress, and there are many guides/plugins that can help you do so.

To answer your question, it does not really make much sense to use w3 total cache to rewrite directories for security.

  • I can understand where you are coming from, but saying that it doesn't make sense to rewrite directories for security doesn't answer my question. I can understand that you disagree with doing it in the first place, but it doesn't help me. I have since found out that this topic is quite regularly discussed and many people disagree with the "security by obscurity" idea. However I think although security and obscurity are different there is some overlap, and both can be useful.
    – baritoneuk
    Aug 10, 2011 at 13:58
  • Asking to alter a caching plugin for security reasons does make no sense and that was your actual question, you should close this and ask another question if you want. It is generally asked by people with poor knowledge of internet security and WordPress. If you can give me a solid real world example of how hiding wp-content is effective, please do.
    – Wyck
    Aug 10, 2011 at 14:58
  • Trying to hide the fact that a site uses Wordpress is useful for a few reasons. However it is definitely not an excuse to be poor at the security of the website. It is very important to update to the latest version especially if a vulnerability has been discovered. However this is difficult to do quickly when you manage multiple WP sites- there might be a delay, and what about going on holiday?! ;-) Also some clients don't want their sites to look like (in their wrong opinion) like "cheapo" WP sites. I might not agree with them, but if that is what the client wants...
    – baritoneuk
    Aug 10, 2011 at 15:06
  • I make this clear, close the question, you asked about W3 total cache. If you have another question about why obscurity is a good/bad idea then create a new question.
    – Wyck
    Aug 10, 2011 at 15:09
  • Oh dear, I'm feeling a bit of negativity here. That's a shame. :-( I'm a new member to Wordpress Stackexchange, and it makes me a little upset when I'm told off like this. Please be nice. The question still stands and has been answered really well by Chris_O. The whole question of obscurity was never part of my original question and isn't something I wanted to discuss. Thanks anyway.
    – baritoneuk
    Aug 10, 2011 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.