WP Ghost with WP Cerber Security – Compatible Configuration and Feature Comparison
October 20, 2021
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
WP Ghost (formerly Hide My WP Ghost) and WP Cerber Security are compatible and complement each other. WP Ghost focuses on hack prevention through path security and firewall rules. WP Cerber focuses on traffic inspection, anti-spam, malware scanning, and automated attack mitigation. Enable shared features (login path, brute force, IP blocking) in one plugin only to avoid conflicts.
How They Work Together
WP Ghost and WP Cerber address WordPress security from different angles. WP Ghost reduces the attack surface by changing and hiding paths, blocking bots with 7G/8G firewall rules, and adding security headers. WP Cerber inspects traffic in real time, blocks malicious requests, provides anti-spam protection, scans for malware, and monitors file integrity. Both can change the login path and limit login attempts — enable these shared features in one plugin only.
What to Activate in Each Plugin
Use WP Ghost for:
All path changes (wp-content, wp-includes, uploads, plugins, themes, comments, REST API, author, admin-ajax), hide old paths, hide common files, 7G/8G firewall, security headers, text/URL/CDN mapping, and change paths in cached files.
Use WP Cerber for:
Anti-spam engine, malware scanning, file integrity monitoring, traffic inspector, automated attack mitigation, and country-based access rules (if you prefer Cerber’s GEO implementation).
Choose one plugin for shared features:
Both can change the login path, limit login attempts, enable reCAPTCHA, ban/whitelist IPs, and disable XML-RPC. Enable these in one plugin only. WP Ghost is recommended for login path changes (it also changes lost password, logout, and activation paths that Cerber does not cover).
Feature Comparison
| Feature Category | WP Ghost | WP Cerber |
|---|---|---|
| Path Security (wp-content, plugins, themes, uploads, REST API, AJAX) | Yes | – |
| Change login, admin, lost password, logout, activation paths | Yes | Login/admin only |
| 7G and 8G Firewall | Yes | – |
| Security Headers (HSTS, CSP, X-Frame-Options) | Yes | – |
| Two-Factor Authentication (Code, Email, Passkeys) | Yes | – |
| Brute Force Protection & reCAPTCHA V2/V3 | Yes | Yes |
| IP Blacklist / Whitelist | Yes | Yes |
| Disable XML-RPC | Yes | Yes |
| Text, URL, and CDN Mapping | Yes | – |
| Country Blocking | Yes | Yes |
| Anti-Spam Engine | – | Yes |
| Malware Scanner | – | Yes |
| File Integrity Monitoring | – | Yes |
| Traffic Inspector | – | Yes |
| Activity Log & Email Alerts | Yes | Yes |
Frequently Asked Questions
Will the two plugins conflict?
Not if you avoid enabling the same feature in both. The shared features (login path, brute force limits, IP blocking, reCAPTCHA, XML-RPC) should be active in one plugin only. Path security is unique to WP Ghost and anti-spam/malware scanning is unique to WP Cerber — these will not conflict.
Do I need WP Cerber if I use WP Ghost?
WP Ghost covers hack prevention (path security, firewall, brute force, 2FA). WP Cerber adds post-attack detection (malware scanning, file integrity) and anti-spam. If you want both prevention and detection, using both is a strong combination. If you only need prevention, WP Ghost alone is sufficient.
Which plugin should handle the login path?
WP Ghost is recommended. It changes the login path plus lost password, logout, register, and activation paths that WP Cerber does not cover. Disable the custom login URL in WP Cerber if you use WP Ghost for this.
Does WP Ghost modify WordPress core files?
No. WP Ghost uses rewrite rules and WordPress hooks. No core files modified. Deactivating restores all defaults.
Related Tutorials
Customize All WordPress Paths – configure WP Ghost’s unique path security features.
Brute Force Protection – configure brute force in WP Ghost (disable in Cerber if using this).
Header Security – enable HSTS, CSP, and other headers unique to WP Ghost.
Compatibility Plugins List – all tested security plugins.
Website Security Check – verify your combined configuration.
