Search: ghost mode

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

Elementor relies on the REST API, admin-ajax.php, and the wp-admin path to load its editor. When WP Ghost changes these paths in Safe Mode or Ghost Mode, Elementor may lose access to them if your server configuration, cache, or other settings are not updated to match. Here is how to fix it step by step.

Check Your Server Type (Nginx Users)

If your server runs Nginx, path changes require a manual update to the …

… presets: Minimal, Safe Mode + Compatibility, Safe Mode + Full Protection, or Ghost Mode + Full Protection. The Safe Mode + Compatibility preset is recommended for most sites. Customize your login path, clear your cache, and run the Security Check to verify everything works. The entire setup takes under five minutes. See the WP Ghost Tutorial for a complete walkthrough.

Frequently Asked Questions

Is WP Ghost the same as Hide My WP Ghost?

Yes. The plugin was renamed from “Hide My WP Ghost” to “WP Ghost” to reflect its expanded focus beyond path hiding. It now covers firewall protection, 2FA, brute force protection, security …

… theme, and often your exact versions. From there, they look up known vulnerabilities and attack.

WP Ghost changes all of these paths so bots find nothing. Here’s how to set it up:

Step 1 – Activate a Security Level

Go to WP Ghost > Change Paths > Level of Security. Select Safe Mode for basic path changes, or Ghost Mode for maximum protection. Click Continue to load the predefined custom paths. Ghost Mode changes all core paths automatically and is the recommended choice for sites that want to be fully invisible to detectors.

Step 2 – Customize Paths (Optional)

WP Ghost fills in …

… nothing. Individual plugin and theme names can be replaced with random codes so even the new paths reveal nothing about your technology stack.

Fingerprint removal. WP Ghost strips the WordPress generator meta tag, version numbers from CSS and JS files, RSD headers, DNS prefetch hints, HTML comments, style IDs, and meta IDs from your page source. These are the secondary signals that theme detectors like BuiltWith, Wappalyzer, IsItWP, and WhatCMS use to identify WordPress when paths alone are not enough.

CMS simulation. WP Ghost can go beyond removing WordPress signals by actively injecting fake Drupal or Joomla fingerprints into …

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

You can hide the WordPress theme name using WP Ghost. The plugin replaces your real theme directory name with a random code in the page source, renames the style.css file that theme detectors read, and blocks access to the original /wp-content/themes/ path. After setup, tools like BuiltWith, Wappalyzer, and WhatWPThemeIsThat cannot identify which theme you are using.

Why Your Theme Name Is a Security Risk

Your active theme’s directory name appears in every …

… than a maintenance mode plugin provides, you can password protect your entire site at the server level. Most hosting control panels (cPanel, Plesk, RunCloud) offer directory-level password protection that blocks all access unless the visitor enters a username and password. This works independently of WordPress, which means even if someone knows your site URL, they can’t view anything without credentials.

This is especially useful if you’re sharing the site with a client for review but want to keep it completely private from everyone else. You can also restrict access by IP address (see the whitelisting section …

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

To hide your WordPress site from bots, scanners, and theme detectors, you need to change the default paths, remove CMS fingerprints from the HTML source, and block access to common WordPress files. WP Ghost does all of this in a single plugin with 115+ free features. After configuration, tools like BuiltWith, Wappalyzer, and IsItWP cannot identify your site as WordPress.

What “Hiding WordPress” Actually Means

Hiding your WordPress site does not mean making it invisible to visitors …

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

If your theme layout breaks or CSS/JS files fail to load after activating Safe Mode or Ghost Mode in WP Ghost, the issue is almost always a server configuration problem or a stale cache. The new paths need to be recognized by your server before they can serve files correctly. Here is how to diagnose and fix it.

Step 1: Clear All Cache

This is the most common cause and the easiest fix. When WP Ghost …

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

If you can’t access your WordPress dashboard through the usual /wp-admin path, it’s almost certainly because WP Ghost is doing its job. The plugin hides the default wp-admin and wp-login.php paths so bots can’t find them. You need to use your custom login URL instead. This guide explains what happened, how to find your custom path, how to disable the hiding if you prefer, and what to do if you …

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

Go to WP Ghost > Change Paths > API Security, switch on Disable XML-RPC Access, and click Save. That is it. The xmlrpc.php file will return a 404 error for all requests, blocking brute force amplification attacks, pingback DDoS abuse, and username enumeration through this endpoint.

Why You Should Disable XML-RPC

XML-RPC is WordPress’s legacy remote communication protocol. It was built before the REST API existed and is rarely needed on modern sites. The …

… WordPress application running on it. WP Ghost works through three pillars of prevention. First, path security: it changes every default WordPress path so bots can’t identify your site as WordPress. Second, firewall filtering: the 8G firewall blocks SQL injection, script injection, and malicious payloads at the server edge. Third, login security: brute force protection with reCAPTCHA and two-factor authentication (including passkeys with Face ID, Touch ID, and Windows Hello) ensure stolen passwords aren’t enough.

WP Ghost includes 115+ free features covering path security, 7G/8G firewall, brute force protection, 2FA, security headers, and hardening options. On …

Yes, WP Ghost works with Elementor Pro’s custom icons feature. Custom icon sets upload and display correctly with all WP Ghost security options active. The icon fonts load through your uploads directory, and WP Ghost’s rewrite rules serve them through the new paths without any issues.

How Elementor Custom Icons Work with WP Ghost

Elementor Pro lets you upload custom icon font packages (ZIP files containing font files and CSS) and use them in your designs. When you upload an icon set, Elementor stores the font files in your directory. WP Ghost changes the uploads path along with …