Does WP Ghost Hide wp-admin on Nginx Servers?

Yes. WP Ghost changes and hides the wp-admin path on Nginx once you add one include line to your Nginx configuration and reload Nginx, which needs shell access. Without shell access you still get a custom login path, brute force protection, the firewall and 2FA, which work without config changes.

How does WP Ghost work on Nginx for wp-admin hiding?

On Apache and LiteSpeed servers, WP Ghost writes rewrite rules to .htaccess automatically. Nginx doesn’t read .htaccess files, so WP Ghost generates a separate hidemywp.conf file containing all the rewrite rules for your custom paths. You add one include line to your Nginx server block and reload the service. After that one-time setup, WP Ghost updates the conf file automatically every time you save settings. You just need to reload Nginx after each change.

The include line looks like this inside your Nginx server block:

include /path/to/wordpress/hidemywp.conf;

After adding the line, reload Nginx:

sudo nginx -s reload

For the complete Nginx setup walkthrough, see the setup WP Ghost on Nginx guide.

What if I don’t have shell access to my Nginx server?

If you’re on managed Nginx hosting (Kinsta, WP Engine, Flywheel, Cloudways, or similar) where you can’t edit the Nginx configuration or restart the service, you have two options.

Option 1: Ask your hosting provider. Contact support and ask them to add the include /path/to/wordpress/hidemywp.conf; line to your Nginx server block and reload the service. Many providers will do this for you. After that, WP Ghost manages the rules automatically.

Option 2: Use WP Ghost without config changes. Load the Minimal (No Config Rewrites) preset in WP Ghost > Change Paths. It turns on a custom login path, brute force protection, the firewall and version hiding without any server configuration, and you can add two-factor authentication. You don’t get the path changes for wp-admin, wp-content, plugins and themes. For the full guide, see using WP Ghost on Nginx without config changes.

Do I need to reload Nginx every time I save WP Ghost settings?

Yes. Unlike Apache, which re-reads .htaccess on every request, Nginx loads its configuration at startup and keeps it in memory. Any change to the rewrite rules requires a reload to take effect. After saving WP Ghost settings, run sudo nginx -s reload (or sudo systemctl reload nginx on systemd-based servers). This applies new rules without dropping active connections.

Frequently asked questions

Does WP Ghost support all Nginx features or just some?

With the Nginx config include in place, WP Ghost supports all features: full path hiding (wp-admin, wp-login, wp-content, plugins, themes, uploads, REST API), firewall, brute force, 2FA, security headers, and everything else. Without the config include, features that rely on URL rewrite rules (path renaming) don’t work, but all WordPress-hook-based features (custom login, firewall, brute force, 2FA, headers) still function normally.

Can I use a custom location for the hidemywp.conf file?

Yes. By default WP Ghost writes hidemywp.conf to the WordPress root. If PHP can’t write there, point WP Ghost to another writable file with the hmwp_config_file filter, then update the include line in your Nginx config to match. For the steps, see the custom Nginx config file guide.

Does this work with WooCommerce on Nginx?

Yes. WP Ghost is fully compatible with WooCommerce on Nginx. Cart, checkout, product pages, and customer accounts all work normally with custom paths and firewall protection enabled.

Does WP Ghost modify WordPress core files?

No. WP Ghost generates a separate hidemywp.conf file and uses WordPress hooks for application-level changes. No core files are modified. Deactivating WP Ghost restores all defaults instantly. The Nginx config include line remains but points to an empty or removed file, causing no issues.