Can I Create Custom CMS Footprints in WP Ghost?

WP Ghost’s CMS Simulator includes Drupal and Joomla as built-in options. You can also set a custom generator name using a WordPress filter, but for best results, the name should match a real CMS that detection tools already recognize. A completely invented name won’t fool scanners because they only identify CMS platforms that exist in their databases.

How CMS Detection Works (and Why Custom Names Have Limits)

CMS detectors like BuiltWith, Wappalyzer, and WhatCMS work by comparing your site’s HTML headers, meta tags, and source patterns against a database of known CMS fingerprints. When WP Ghost’s CMS Simulator injects Drupal or Joomla signatures, these tools recognize the patterns because Drupal and Joomla are in their database. The detector confidently reports “Drupal” or “Joomla” instead of WordPress.

If you inject a completely made-up generator name like “MyCoolCMS,” detectors won’t recognize it. They will either report “Unknown” or continue looking for other signals. A result of “Unknown” is still better than “WordPress” from a security perspective, since bots won’t load WordPress exploit toolkits against an unknown target. But a recognized CMS like Drupal actively sends attackers down the wrong path, which is more effective.

Using the Built-in CMS Simulator

The easiest approach is to use WP Ghost’s built-in options. Go to WP Ghost > Change Paths > Level of Security, activate Safe Mode or Ghost Mode, then select a CMS from the Emulate CMS dropdown. The available options include multiple Drupal and Joomla versions. Click Save, and WP Ghost immediately injects the selected CMS fingerprints into your HTML source. No code needed. For the full walkthrough, see the Simulate Drupal or Joomla CMS tutorial.

Adding a Custom Generator Name with Code

If you want to use a generator name that is not in the built-in dropdown, you can use the hmwp_emulate_cms filter. Add the following code to your theme’s functions.php file or a custom plugin:

add_filter('hmwp_emulate_cms', function(){
  return 'Drupal 11';
});

Replace 'Drupal 11' with whatever CMS name you want to display. For the best results, use a real CMS name that scanners already recognize (like a specific Drupal or Joomla version, Magento, Shopify, etc.). If you use a name that doesn’t exist in any detection database, scanners will simply report it as unknown. For the complete developer guide, see Adding a Custom CMS Simulator.

Frequently Asked Questions

Should I use a custom generator name or stick with the built-in Drupal/Joomla options?

Stick with the built-in options unless you have a specific reason to change. WP Ghost’s Drupal and Joomla presets inject multiple fingerprints beyond just the generator tag, including headers and HTML patterns that match the real CMS. A custom generator name only changes the <meta name="generator"> tag, which is just one of many signals detectors look for. The built-in presets are more thorough.

Will a made-up CMS name still help with security?

Partially. Bots that rely on the generator tag to identify WordPress will not find a WordPress match, so they may skip your site. But most serious scanners check multiple signals, not just the generator tag. A made-up name results in “Unknown CMS” status, which is better than “WordPress” but less effective than a recognized CMS like Drupal that actively misdirects attackers.

Does the CMS Simulator work without changing paths?

Technically yes, but it won’t be effective. If your page source still contains /wp-content/, /wp-includes/, and /wp-admin/, scanners will detect WordPress regardless of the fake generator tag. The CMS Simulator is designed as the final layer: remove the real WordPress signals first with path security, then inject the fake CMS signals.

Does WP Ghost modify WordPress core files?

No. The CMS Simulator injects fake signatures through WordPress filters at runtime. No files are written to disk. Disabling the CMS Simulator or deactivating WP Ghost removes all fake signals instantly.