Ghost 1
Best for: freelancers, blogs
$196
$1.02/mo
$1.02 / site / month
Protect My SiteToday you pay $49 for 48 months.
- 1 Website
- All premium features included
- Renews after 48 months at $49/yr.
- Paddle Secure Payment
- Priority email support
48 months of WP Ghost from $49. That's $1.02 a month, paid up front.
Ends Friday 4 December at 23:59 ETBest for: freelancers, blogs
$1.02/mo
$1.02 / site / month
Protect My SiteToday you pay $49 for 48 months.
Best for: small businesses, devs
$2.48/mo
$0.50 / site / month
Protect 5 SitesToday you pay $119 for 48 months.
Best for: medium businesses
$4.15/mo
$0.17 / site / month
Protect 25 SitesToday you pay $199 for 48 months.
Best for: WordPress agencies
$6.23/mo
Unlimited sites
Protect All My SitesToday you pay $299 for 48 months.
250,000+sites protected
100M+threats blocked every month
4.8on G2, Capterra and AppSumo
Pay once, with no renewal at all. Same sale, same end date.
Best for: agencies
$199
$39.80 / site · lifetime
Get Lifetime Access - 5 SitesBest for: agencies
$399
$15.96 / site · lifetime
Get Lifetime Access - 25 SitesBest for: agencies
$599
from $0.60 / site · lifetime
Get Lifetime Access - 1k SitesIt runs a checklist. /wp-login.php, /wp-admin/, /xmlrpc.php, your plugin folder, the REST API user endpoint. One of them answering is all it takes to confirm a WordPress site and start the real attack. Which is why moving one path isn't enough.
How to hide WordPress common pathsYour login, admin, plugin, theme, and API paths get new URLs. Nothing in WordPress core is modified. It works through rewrite rules and filters and reverses instantly on deactivation.
How to change and hide the wp-admin pathYou choose the replacement paths. These are examples.
Every default path returns 404. The 2026 Ghost Firewall blocks remaining threats at the server edge before PHP starts. The bot logs a dead site and leaves.
Explore the 2026 Ghost FirewallAutomatically block repeat offenders based on custom threshold rules you control. Gain total visibility with a comprehensive Security & User Events Log, featuring advanced filters, full-text search, a live GEO threat map, real-time email alerts, and 30-day cloud storage with seamless CSV exporting.
Monitor blocked attacks in the Security Threats Log
Sample data on our demo site.
Sample data on our demo site.
Geo-block specific countries site-wide, exclusively on login pages, or per custom path (with easy IP allowlisting for your team).
This same firewall actively intercepts GPTBot, ClaudeBot, and 30+ other AI web crawlers, protecting your content and bandwidth with dynamically updated robots.txt rules in every release.
How to block countries in WordPressIt runs from 6 November until Friday 4 December at 23:59 ET.
The whole amount, up front. Ghost 5 for 48 months is $119 today, which works out at $2.48 a month. You aren't billed monthly.
After 48 months it renews at $49, $119, $249 or $499 a year for 12 months, depending on the plan. Cancel anytime. A 12-month plan bought in the sale renews at the price you pay today.
Your plan keeps its price and you don't need to do anything.
No. VAT or sales tax is added at checkout, and you see the total before you pay.
Ends Friday 4 December at 23:59 ET
Shop nowPrices are in US dollars and exclude local tax.