Ideal Hide My WP Ghost Settings – Best Practice 2024

Learn how to set up Hide My WP Ghost in Ghost Mode and activate all security features you need for a stronger and safer website in just 6 minutes.

VIDEO OUTLINE

1. Min. 1.00 – 1.33: Select and Save GHOST MODE
2. Min. 1.33 – 2.24: Change Paths Settings
3. Min. 2.25 – 3.43: Tweaks Settings
4. Min. 3.43 – 4.07: Brute Force Settings
5. Min. 4.08 – 4.36: Events Log Settings
6. Min. 4.36 – 5.29: Security Check
7. Min. 5.29 – 6.28: View Changes

👉 Min. 01.00 – 1.33: Select and Save GHOST MODE

Recommended Actions:

• Select Ghost Mode
• A pop-up will appear showing you all the predefined paths that Hide My WP Ghost sets in Ghost Mode. READ the info.
• Click on Continue, and then SAVE.
• Run the Frontend Login test. 
• SAVE your login URL (!very important that you do this)
• SAVE your SAFE URL (!also very important, you’ll need this in case you can’t login)
• If the test is successful, click on Yes, it’s working.

👉 Min. 1.33 – 2.24: Change Paths Settings

Admin Security

• Custom Admin Path – Recommended action: Leave as is
• Hide wp-admin – Recommended: ON 
• Hide wp-admin From Non-Admin users – Recommended: ON
• Hide the New Admin Path – Recommended: ON

Login Security

• Custom Login Path – Recommended action: Leave as is
• Hide wp-login.php – Recommended: ON 
• Hide login Path – Recommended: ON
• Custom Lost Password Path – Recommended action: Leave as is
• Custom Register Path – Recommended action: Leave as is
• Custom Logout Path – Recommended action: Leave as is

Ajax Security

• Custom admin-ajax Path – Recommended action: Leave as is
• Hide wp-admin from Ajax URL – Recommended: ON
• Change Paths in Ajax Calls – Recommended: ON

User Security

• Custom Author Path – Recommended action: Leave as is
• Hide Author ID URL – Recommended: ON

WP Core Security

• Custom wp-content Path – Recommended action: Leave as is
• Custom wp-includes Path – Recommended action: Leave as is
• Custom uploads Path – Recommended action: Leave as is
• Custom comment Path – Recommended action: Leave as is
• Hide WordPress Common Paths – Recommended: ON
• Hide File Extensions – Recommended action: Leave as is

Plugins Security

• Custom plugins Path – Recommended action: Leave as is
• Hide Plugin Names – Recommended: ON
• Hide All the Plugins – Recommended: OFF
• Hide WordPress Old Plugins Path – Recommended: ON
• Show Advanced Options– Recommended: OFF

Themes Security

• Custom themes Path – Recommended action: Leave as is
• Hide Theme Names – Recommended: ON
• Hide WordPress Old Themes Path – Recommended: ON
• Custom theme style name – Recommended action: Leave as is
• Show Advanced Options – Recommended: OFF

API Security

• Custom wp-json Path – Recommended action: Leave as is
• Hide REST API URL link – Recommended: ON
• Disable REST API access – Recommended: OFF
• Disable XML-RPC access – Recommended: ON
• Disable RSD Endpoint from XML- RPC – Recommended: ON

Firewall and Headers

• Add Security Headers for XSS and Code Injection Attacks – Recommended: ON
• Strict-Transport-Security – Recommended: ACTIVE, leave as is
• Content-Security-Policy – Recommended: ACTIVE, leave as is
• X-XSS- Protection – Recommended: ACTIVE, leave as is
• X-Content-Type- Options – Recommended: ACTIVE, leave as is
• Cross-Origin-Embedder- Policy – Recommended action: ADD then leave as is
• Cross-Origin-Opener-Policy – Recommended action: ADD then leave as is
• X-Frame-Options – Recommended action: ADD then leave as is
• Remove Unsafe Headers – Recommended: ON
• Block Theme Detectors Crawlers – Recommended: ON
• Firewall Against Script Injection – Recommended: ON

👉 Min. 2.25 – 3.43: Tweaks Settings

Redirects

• Redirect Hidden Paths – Recommended action: Leave as is (redirects hidden paths to your front page)
• Do Login & Logout Redirects – Recommended: OFF

Feed and Sitemap

• Hide Feed and Sitemap Link Tags – Recommended: ON
• Change Paths in RSS feed – Recommended: ON
• Change Paths in Sitemaps XML – Recommended: ON
• Hide Paths in Robots.txt – Recommended: ON

Change Options

• Change Paths for Logged Users – Recommended: ON
• Change Relative URLs to Absolute URLs – Recommended: OFF

Hide Options

• Hide Admin Toolbar – Recommended: ON
• Select User Roles – Recommended action: Select the users roles for whom you DON’T want the Admin Toolbar to be visible.
• Hide Version from Images, CSS and JS in WordPress – Recommended: ON
• Hide IDs from META Tags – Recommended: ON
• Hide WordPress DNS Prefetch META Tags – Recommended: ON
• Hide WordPress Generator META Tags – Recommended: ON
• Hide HTML Comments – Recommended: ON
• Hide Emojicons – Recommended: ON
• Hide Embed Scripts – Recommended: ON
• Disable WLW Manifest scripts – Recommended: ON

Disable Options

• Disable Right-Click – Recommended: ON
• Disable Click Message – Recommended action: Leave as is, customization is not mandatory
• Disable Inspect Element – Recommended: ON
• Disable Inspect Element Message – Recommended action: Leave as is, customization is not mandatory
• Disable View Source – Recommended: ON
• Disable View Source Message – Recommended action: Leave as is, customization is not mandatory
• Disable Copy/Paste – Recommended: ON
• Disable Copy/Paste Message – Recommended action: Leave as is, customization is not mandatory
• Disable Drag/Drop Images – Recommended: OFF
• Disable DB Debug in Frontend – Recommended: ON

👉 Min. 3.43 – 4.07: Brute Force Settings

• Blocked IPs report – Recommended action: Activate Brute Force Protection
• Bruce Force Settings >> Use Brute Force Protection – Recommended: ON

!! In most cases, the Math reCAPTCHA is enough to protect your website against Brute Force login attacks.

• Max fail attempts – Recommended action: Leave as is or customize based on preferences
• Ban Duration – Recommended action: Leave as is or customize based on preferences
• Lockout Message – Recommended action: Leave as is, customization is not mandatory

👉 Min. 4.08 – 4.36: Events Log Settings

• Events Log Report – Recommended action: Activate Log Users Events
• Events Log Settings >> Log Users Events – Recommended: ON
• Log User Roles – Recommended: Leave as is (Hide My WP will log all user roles), or select specific user roles whose activity you want Hide My WP Ghost to log.

👉 Min. 4.36 – 5.29: Security Check

Recommended Actions:

• Click on Start Scan to run a new WordPress security check. 
• Check the list of Action Items that Hide My WP Ghost generated.
• See if there are still issues that need to be resolved.
• Follow the instructions to try and fix as many of them as possible.

By setting up Ghost Mode for your site, you’ve strengthened your site’s security, as shown by the graphic.

👉 Min. 5.29 – 6.28: View Changes

Recommended Actions: 

• Click on Visit Site to see the changes you’ve enabled using Hide My Ghost take effect.
• Log out from your account if you want to test things like: Right Click, View Source, and you’ll see that this functionality has been disabled for your site (based on your settings)
• Take a look at your site’s source code to see the modified paths.

IMPORTANT! The settings shown in this video will work best for most sites – and present a way to quickly, safely, and effectively set up Ghost Mode for your site.

However, the ideal settings can look different from case to case, and you can always further customize these settings based on your needs and wants. 

We advise you to always read the documentation that we link to from within the plugin and ensure you clearly understand what each setting enables you to do.

NOTE!

👋 How to Fix 403 Forbidden Error in WordPress caused by ModSecurity (mod_security)

ModSecurity is an open-source firewall application (or WAF) supported by different web servers (such as Apache, Nginx, IIS) and used by a lot of hosts.

The issue: If they have rule #212340 in place – which they most likely do by default – then it will prevent the Code Editor from working in Ghost Mode from Hide My WP Ghost.

The solution: If you encounter this issue, make sure to contact your host to turn off Rule 212340 or whitelist you from it.

Once you do that, you should no longer see the 403 Forbidden Error.