0

I am trying to hide all version number on my WordPress site. Is it possible to remove the ver= version number from the stylesheet link in the wp-login.php page?

href='https://example.com/wp-admin/load-styles.php?c=0&dir=ltr&load%5B%5D=dashicons,buttons,forms,l10n,login&ver=4.9.8'

I already have the following in my functions.php:

remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

function shapeSpace_remove_version_scripts_styles($src) {
    if (strpos($src, 'ver=')) {
        $src = remove_query_arg('ver', $src);
    }
    return $src;
}
add_filter('style_loader_src', 'shapeSpace_remove_version_scripts_styles', 9999);
add_filter('script_loader_src', 'shapeSpace_remove_version_scripts_styles', 9999);

Can someone please explain why this has been down voted so that I can improve the question? It shouldn't matter why I want to do it, asking whether something is possible is still a valid question.

The OWASP Application Security FAQ specifically recommends hiding version numbers and so it is a legitimate security step towards increasing the security of an application.

  • 2
    I know this is not what you want to hear: But why? If you think this increases security: forget it. First: There are always ways to identify the WP version you'll miss. But even more important: Hackers don't check the version. They just attempt using an exploit often without even checking if the site runs on WordPress at all. – kraftner Dec 18 '18 at 17:56
  • @kraftner if you make sure to have a boilerplate that always remove all the version numbers then there is none left.. often there are penetration tests performed and the results demand that you remove specific locations of the version otherwise an application won't be approved for deployment. Lastly hackers do definitely look at the version number since they can simply check all the exploits that haven't been fixed in specific versions yet. – Jeffrey von Grumbkow Dec 28 '18 at 14:41
0

Of course, it's possible to remove the version number. Follow these steps:

  1. Login to cPanel. Click on File Manager icon.
  2. Choose document root or the public_html directory.
  3. Open wp-content folder.
  4. Click on the themes folder. Then open your active WordPress theme folder.
  5. Scroll down to find functions.php file. Right-click and select Edit.
  6. Add the following codes in functions.php file:

    functionwp_remove_version() {
    return'';
    }
    add_filter('the_generator', 'wp_remove_version');
    
  7. Finally, click on the Save Changes button from the top-right corner.

Now, you will find that the WordPress version number has been removed from the stylesheet link. You can find more information about these steps right here.

  • The code provided works, but I'd advice to write it in a general matter as not everyone has cPanel – Jeffrey von Grumbkow Dec 28 '18 at 14:40
  • You clearly haven't read my question correctly or tested your answer as your answer is a variant of the code I have tried in my question and it doesn't solve the problem. – nigelhooper Jan 10 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.