Yearly
Lifetime
Ghost 5 LTD
For Agencies
$600
$
180
70% Discount
One-Time Payment
-
Secure & Protect
-
5 Websites
Buy Now
Paddle Secure Payment
70% OFF
Ghost 10 LTD
For Agencies
$1196
$
360
70% Discount
One-Time Payment
-
Secure & Protect
-
10 Websites
Buy Now
Paddle Secure Payment
70% OFF
Ghost 1000 LTD
For Agencies
$2560
$
640
70% Discount
One-Time Payment
-
Secure & Protect
-
1000 Websites
Buy Now
Paddle Secure Payment
70% OFF
Ghost 1
For Bloggers
$
29
Next year bill $29.99
99
Next year bill $29.99
-
Secure & Protect
-
1 Website
Buy Now
Paddle Secure Payment
Ghost 5
For Small Businesses
$149
$
52
50
65% Discount
Next year bill $52.50
-
Secure & Protect
-
5 Websites
Save $97
Paddle Secure Payment
65% OFF
Ghost 10
For Midsize Businesses
$299
$
90
00
70% Discount
Next year bill $90.00
-
Secure & Protect
-
10 Websites
Save 209
Paddle Secure Payment
70% OFF
Ghost All
For Agencies
$
192
70% Discount
Next year bill $192.00
00
70% Discount
Next year bill $192.00
-
Secure & Protect
-
Unlimited Websites
Save 448
Paddle Secure Payment
70% OFF
What's included
- Hide WordPress Common Paths
- Hide WordPress Common Files
- Protect WordPress Paths
- Script Injection Attacks Protection
- SQL Injection Attacks Protection
- Activity Logs & Alerts
- Brute Force Attack Protection
- 7G & 8G Firewall Protection
- Two Factor Authenticator (2FA)
- Country Blocking (GEO Security)
- Temporary Login Access
- Cross-Site Scripting (XSS) Protection
- XML-RPC Attacks Protection
- One-click Security Fix
- and more ...
Customers Feedback
Hide My WP Ghost helped over 100k companies to protect their WordPress websites.
"...The setup of the plugin is extremely easy. It runs very fast, and it does what it is promising. For a little investment you own a PRO version, and everyone should opt for that. The man behind this plugin is also freaking amazing. He has 20 years of development experience, and he can really do all. I adore such people, and the more when they have a great personality. So, my experience with both the plugin and the custom support is more than 5 star worth. THANK YOU JOHN !!!"
"I purchased the paid version. I've tried several other paid “Hide WP” and this was super easy to install but most of all the support is fantastic. I had a little hiccup with my theme but John got right on it and solved it immediately. The other very popular Hide WP plugin wouldn't work with my theme, I waited weeks and never go a solution. So glad I found this little gem!"
"..This plugin guarantees they’ll make the plugin work on your site, or they’ll give your money back.
And that was exactly the case for me. Their support responded immediately and made everything they needed to solve the issue.
That’s what I look for on services, trustworthy people who are willing AND happy to solve my problem/s.
The plugin works perfectly with my WordPress installation now."
"It’s working perfect and I’m glad there are still some good developers that are on WordPress that actually care about their plugins. Most don’t and that’s horrible.
Most just try to blame it on other things and don’t even bother to see what the issue is.
Anyways. It’s got a lot of options to it and perfect for a security plugin and really simple to use. Take it from me. USE IT."
Free Version vs. Premium Version
Paths Security Features
- Change wp-admin path
- Change wp-login.php path
- Change lost password, register, activation, logout paths
- Change wp-content path
- Change wp-includes path
- Custom wp-includes URL
- Change uploads path
- Change author path
- Change comments path
- Change admin-ajax.php path
- Change REST API wp-json path
- Change plugin directory path
- Change theme directory path
- Hide plugin names with random names
- Hide theme names with random names
- Hide WordPress old plugins path
- Hide WordPress old themes path
- Hide WordPress common paths
- Custom theme style name
- Custom login/logout/register redirects by user role
- Frontend Test to verify paths load correctly
- Change paths in cache files
- Change paths in sitemaps
- Change paths in robots.txt
- Change paths in RSS feeds
- Ghost Mode (maximum path security)
- Hide file extensions (PHP, CSS, JS, TXT, media)
- Hide WordPress common files
- Manually customize each individual plugin name
- Manually customize each individual theme name
Firewall Features
- 7G Firewall filter
- 8G Firewall filter
- Script injection protection
- SQL injection protection
- Security headers (HSTS, CSP, X-Frame-Options ...)
- Remove unsafe headers (PHP version, server info ...)
- Block Theme Detector crawlers
- IP whitelist
- IP blacklist
- User agent blacklist
- Referrer blacklist
- Hostname blacklist
- Whitelist paths
- Automate IP blocking (auto-block repeat offenders)
- Configure automation rules (attacks, time window, block duration)
- Block AI Crawler Bots at firewall level (30+ crawlers)
- Automatic robots.txt Disallow rules for AI crawlers
- AI crawler list updated automatically with each release
Brute Force Protection Features
- Protection on login form
- Protection on lost password form
- Protection on signup form
- Protection on comments form
- Protection on WooCommerce login, signup, lost password
- Google reCAPTCHA v2, v3, Enterprise
- Math reCAPTCHA
- Custom attempt limits
- Custom lockout duration
- Custom warning messages
- Block wrong usernames immediately
Brute Force Protection Features
- Protection on login form
- Protection on lost password form
- Protection on signup form
- Protection on comments form
- Protection on WooCommerce login, signup, lost password
- Google reCAPTCHA v2, v3, Enterprise
- Math reCAPTCHA
- Custom attempt limits
- Custom lockout duration
- Custom warning messages
- Block wrong usernames immediately
Authentication Features
- Two-Factor Authentication by code
- Two-Factor Authentication by email
- Two-Factor Authentication by passkey
- User selects preferred 2FA method in profile
- Trust current browser (skip 2FA on trusted devices)
- Magic Link login (one-time passwordless email link)
- Temporary Logins (time-limited access links)
Security Monitoring Features
- Security Optimization Score (0-100)
- GEO Threats Map with top 5 threat countries
- Threats prevented chart (7-day view)
- Lifetime attacks blocked counter
- Weekly domain security monitoring email
- Security Check with numeric score and task list
- Notification to activate firewall when unblocked threats detected
- Security Threats Log (last 20 entries)
- User Events Log (last 20 entries)
- Security Threats Log with full history, unlimited entries
- User Events Log with full history, unlimited entries
- Filter logs by threat type
- Filter logs by status
- Filter logs by country
- Filter logs by time range
- Full-text search in logs
- Export Security Threats Log to CSV
- Export User Events Log to CSV
- Cloud storage for events log (30-day retention)
- Log user roles filter
- User Events Log
Geo Security Features
- GEO Threats Map on Overview dashboard
- Top 5 threat countries with attack counts
- Country Blocking (block entire countries)
- Path-based country blocking
Login Page Designer Features
- Custom logo with live preview
- Custom logo link URL
- Background image with blur and overlay controls
- Page background color
- Form background color
- Button color
- Text color
- Link color
- 10 color scheme presets
- 12 layout presets
Hiding & Footprint Removal Features
- Remove WordPress version tags
- Remove Generator meta tag
- Remove RSD header
- Remove WLW Manifest link
- Remove WordPress HTML comments
- Hide admin toolbar by user role
- Hide REST API URL link
- Hide rest_route parameter
- Disable emoticons script
- Text Mapping (change class names and IDs)
- URL Mapping (change URLs dynamically)
- CDN Mapping
- Hide Source Map References
- Hide User Enumeration
Disable Options
- Disable XML-RPC
- Disable REST API access for non-authenticated users
- Disable rest_route parameter access
- Disable embed scripts
- Disable database debug
- Disable directory browsing
- Disable right-click (for visitors and by user role)
- Disable Inspect Element (for visitors and by user role)
- Disable View Source (for visitors and by user role)
- Disable Copy/Paste (for visitors and by user role)
- Disable Drag/Drop (for visitors and by user role)
Database & Server Hardening Features
- Security Check identifies permission, prefix, username, SALT issues
- Fix weak admin/administrator usernames
- Fix file and directory permissions (quick and complete)
- Change database table prefix
- Regenerate WordPress SALT keys
- Fix WordPress debugging mode
- Fix WordPress debugging mode
- Disable plugin/theme editor
Setup & Compatibility Features
- One-click security presets (3 levels)
- Frontend Test and Login Check
- Backup and restore settings
- Pause plugin for 5 minutes for safe testing
- Dark mode support
- Translations in 16 languages
- Compatible with Apache, Nginx, LiteSpeed, IIS
- Compatible with 20+ hosting providers
- Compatible with all popular plugins
- Compatible with 15+ cache plugins
Support
- Knowledge base (wpghost.com/kb)
- Community support (WordPress.org forums)
- Free setup assistance
- Priority support with direct access to security experts
- Faster response times
Frequently Asked Questions
If you purchase a yearly plan, you get access to all security updates, features, and fast replies to support requests for 1 year.
You can cancel the yearly plan anytime without affecting your website security.
After the subscription expires, you can still use the plugin without future support and compatibility updates.
You can use the free version of the plugin on any number of websites, whether or not they are owned by you.
The Ghost version can be installed on a limited number of websites, and you can transfer your license if you change your website.
This license is limited to the number of websites you use it on.
This means that you have to activate the product with a license for each website you want to use a product on.
For WordPress Multisite, the license is for the entire network.
Of course! Just deactivate the plugin from the previous domain, and activate it on the new one.
You can manage it in your account via Manage License.
We offer a full refund for the first 30 days after purchase, based on our Refund Policy.
The Hide My WP Ghost Lite version offers the basic security options for your website, while the plugin offers you a powerful security level to prevent most of the WordPress attacks made by both humans and bots. More details
You can use PayPal or any credit card to buy the plugin.
We use the Paddle gateway, which supports over 45 payment methods
You can save all the settings from the Free version and restore them after you activate the premium version.
For NGINX servers, you will need to do manual setup through SSH or SFTP to add the rewrite file into nginx.conf and reload the service.
Read the NGINX step-by-step tutorial here:
https://hidemywpghost.com/how-to-setup-hide-my-wp-on-nginx-server/
Note! Contact your host first and ask him if he can help you with it.
The plugin works on almost any WordPress server, but there are a few servers you can’t use Hide My WP Ghost with:
1. WordPress.com Business – doesn’t support a different login path and uses a shared NGINX hosting without the possibility to configure the rewrite rules.
2. Shared NGINX Hosting who doesn’t have the SSH option and refuses to add the Hide My WordPress Ghost config file and reload the NGINX settings.
Yes, you do!
Access the Knowledge Base for more answers or contact us.
To get answers to more questions, visit our complete FAQ page or contact us.
LAST UPDATE
6 Apr 2026
Compatible WP 7.0.x & PHP 8.5
VIDEO TUTORIALS
Youtube Channel
KNOWLEDGE BASE
Tutorials & FAQs
Awesome Integration
- WordPress Multisites
- Apache Server
- NGINX Server
- Bitnami Servers
- Hostgator Hosting
- Hostinger Hosting
- Flywheel Hosting
- WpEngine Hosting
- LiteSpeed Server
- Google Cloud Hosting
- Godaddy Hosting
- BlueHost Hosting
- SiteGround Hosting
- Flywheel Local
- Host1plus Hosting
- Fastcomet Hosting
- InMotion Server
- Dreamhost Hosting
- Bitnami Hosting
- IIS server
- CloudPanel server
Secure Your Website!
Protect Your Business!
Speed BONUS
INCREASE YOUR WEBSITE SPEED
There are more and more plugins available that can hide common paths. To ensure the best results, you should consider using the fastest option available.
A slow website can put your website’s SEO and security at risk. For this reason, it is best to use Hide My WP Ghost for increased protection without compromising on speed.
= 9.0.03 (06 April 2026) = * Fix - Fixed an issue where the Dark Mode popup remained white and some settings fields were too dark * Fix - Fixed Login Page Design to work in Disable mode * Fix - Fixed Firewall whitelist IPs and paths to work in disabled mode when the Firewall is activated * Fix - Fixed minor bugs and typos = 9.0.01 (30 March 2026) = * New - Country filter in Security Threats Log and User Events Log * New - Click on a country circle in the GeoMap to open Security Threats Log filtered by that country for the last 7 days * Update - Moved Export CSV button to below the table in Security Threats Log and User Events Log to avoid accidental clicks * Update - Added proper color handling for dark mode (browser-based) * Update - Enhanced security progress indicator and introduced Security Optimization Score * Update - Add a loading process on login submit * Fix - GeoMap country circle counts now match Security Threats Log counts for the same 7-day window * Fix - Security Threats counting for the last 7 days on widget now matches the log totals (timezone-aligned day buckets) * Fix - Passkey login spinner not showing due to missing classList calls * Fix - Country codes missing from threats log rows now resolved on-the-fly from GeoIP when cron is not running * Fix - Resolved robots.txt warning when user agents are blocked = 9.0.00 (26 March 2026) = * New - Customize the login page with custom logo (with live preview), logo link URL, and color scheme (page, form, button, text, link colors) with one-click presets * New - Block AI Crawler Bots at firewall level with automatic robots.txt Disallow rules (GPTBot, ClaudeBot, PerplexityBot, Bytespider, and 30+ others) * New - GEO Map with top 5 threat countries visualization on the Overview dashboard * New - Export Security Threats Log and User Events Log to CSV * New - Security Check task to verify IP block automation is configured correctly * New - Threats count in the Overview widget now shows the full 7-day period totals * New - Notification in the Overview widget to activate 7G/8G Firewall when unblocked threats are detected * Update - Store country code in the threats log table for faster country stats * Update - Missing country codes resolved in background via cron without slowing down threat logging = 8.3.07 (16 March 2026) = * Fix - Sorting and filtering in the Events Log & Security Threats Log * Fix - Rules and Threats filters to work with WP Multisite subpaths structure * Fix - Temporary login user edit link on WP Multisite * Fix - Compatibility with Woocommerce 10.6 * Fix - Compatiibility with the Blocksy theme * Fix - Optimize the plugin speed = 8.3.06 (09 March 2026) = * Update - JS requirements for WordPress 6.9.2 * Fix - Security Log and Events Log not recording properly * Fix - Optimize user logged in verification * Fix - Don't show the 2FA and Magic Login form when the Safe URL parameter is set * Fix - Prevent logging out when the paths are changed * Fix - Sending the code too often on 2FA Email verification. The code can be resent only every 30 seconds. * Fix - Remove unused JS, CSS and fonts * Fix - Compatiibility with the Blocksy theme * Fix - Compatiibility with the new WP 6.9.4 = 8.3.04 (02 March 2026) = * Update - Remove the option to send the new paths by email as the are already on WP Ghost dDashboard * Update - Send the Brute Force, 2FA and Magic Login texts to the multilingual plugins like WPML and Polylang * Update - Add the Magic Login options to Change Paths > Login Security section * Update - Compatibility with PHP 8.5 * Fix - Small bugs and typos = 8.3.03 (25 Feb 2026) = * New - Added Automation on IP address blocking in the Firewall * Update - Added compatibility with Photo Gallery from 10Web * Update - Translations in all 14 languages * Update - Moved 2FA and Magic Login feature in WP Ghost core * Update - UI for Security Threats Log and Events Log * Update - Plugin core security acording to the latest WordPress security recommendations * Fix - Firewall rules to work with the new WordPress 6.9.2 update = 8.3.01 (10 Feb 2026) = * Update - Add the option to hide AI Bots in the Firewall > Block User Agents * Fix - Fatal error on log table creation when the plugin is activated * Fix - Safe URL parameter on login form to prevent 2FA from showing when is activated = 8.3.00 (07 Feb 2026) = * New – Security Threats Log added to track blocked attacks and malicious requests * Change – Events Log renamed to Logs, now split into User Events and Security Threats * Update – Expanded 7G / 8G Firewall rules to block advanced brute-force attempts, SQL injection, XSS payloads, file inclusion, directory traversal, and automated vulnerability scans before reaching WordPress * Update – Improved threat detection to stop malicious requests before WordPress core execution * Update – Added advanced request pattern analysis to identify and block malicious payloads * Update – Enhanced threat classification to clearly separate blocked attacks from allowed traffic in security logs * Update – Optimized firewall execution path to reduce overhead and improve performance under high attack traffic = 8.2.18 (02 Jan 2026) = * Update - Added the option to Hide Source Map References * Fix - Brute Force compatibility with Elementor Pro on form submit * Fix - Update Google reCaptcha JavaScript to work with Woocommerce Ajax = 8.2.17 (09 Dec 2025) = * Fix - Remove the wp- and admin path from prefetch paths in WP 6.9 * Fix - Small bugs and warnings = 8.2.16 (01 Dec 2025) = * Update - Compatibility with WP 6.9 * Update - 2FA to allow each user to select the 2FA method in the profile * Update - 2FA to connect through passkey and fingerprint * Update - 2FA to trust the current browser = 8.2.15 (29 Sept 2025) = * Update - Compatibility with the plugin WP Social & WP Social PRO * Update - Compatibility with LiteSpeed Quic Cloud on IPV6 * Update - Make REST API test work when permalinks are set to the default PHP parameter * Update - Minimum PHP version required is 8.0 in the Security Check section = 8.2.14 (22 Aug 2025) = * Update - Firewall rules for more compatibility * Update - Safe URL verification process * Update - Compatibility with the plugin Debloat * Update - Compatibility with WP Social login customization = 8.2.13 (08 July 2025) = * Update – Compatibility with Riode theme on Brute Force protection * Update – Compatibility with WP Engine and added support for Bulk Rewrite Rules * Fix – Plugin update check error message = 8.2.12 (19 June 2025) = * Update – 7G & 8G Firewall for more compatibility with WP Plugin * Update – Compatibility with Kadence Blocks = 8.2.11 (27 May 2025) = * Update – Compatibility with the WP 6.8 * Update – Firewall compatibility with WooCommerce * Update – Add AI support in the plugin settings * Fixed – Function _load_textdomain_just_in_time was called incorrectly * Fixed – Compatibility WooCommerce login/register with reCaptcha V3 = 8.2.10 (11 Apr 2025) = * Update – Compatibility with WordPress version 6.8 * Fix – File security when the rewrite rules are not loaded correctly * Fix – Prevent Brute Force from updating the warning text without space when switched off * Fix – Prevent PHP warning when IP address unknown in Brute Force IP check * Fix – Load i18n on the login page for password-strength-meter messages when the Clean Login option is activated * Fix – Detect if parent theme has caps when child theme is activated * Fix – Dynamic file mapping to load through index.php for better compatibility with all server types = 8.2.04 (07 Mar 2025) = * Update – Add the option to customize all active and inactive themes * Fix – Brute Force error in comments when no recaptcha option is selected * Fix – WP Multisite root directory for custom WP directory installation = 8.2.03 (04 Mar 2025) = * Update – Security update on wp-activate.php path call * Fix – Headers check on Brute Force to get the real IP behind Proxy * Fix – Admin layout issue when other plugins notification is loading in Wp Ghost settings * Fix – Remove newlines from the rewrite rules = 8.2.01 (26 Feb 2025) = * Update – Add Google reCaptcha Enterprise * Update – Increase security on Brute Force feature * Update – Compatibility with Sucuri plugin on Events Log and Brute Force * Update – Add the HMWP_CONFIG_DIR constant to define the config root path * Update – Translations files for the last text changed * Fix – Get the real IP address behind proxy * Fix – Brute Force compatibility with Advanced Pack Magic Login and small bugs * Fix – Include parent theme in the custom theme name list if the child theme is loaded = 8.1.04 (06 Feb 2025) = * Update – New WP Ghost Dashboard design * Update – Login Attempt and Blocked IPs chart in WP Ghost Dashboard * Update – Email Alerts log report in WP Ghost Dashboard * Fix – Paths changed in dynamically loaded CSS and JS files * Fix – Prevent redirecting URLs to hidden paths on config rules issue * Fix – Prevent hiding the wp-admin on config rules issue * Fix – Prevent changing the wp-admin on config rules issue = 8.1.03 (22 Jan 2025) = * Update – Knowledge Base links and responsive layout * Update – GeoIP Country database for Geo-Blocking * Fix – Config update issue when saving the whitelist from Level Of Security = 8.0.21 = * Update - Added gif and tiff to media redirect in Hide WP Common Paths * Update - Allow activating hmwp_manage_settings capability only for a user using Roles & Capabilities plugin * Fixed - Layout and improved functionality = 8.0.20 = * Update - Compatibility with WP 6.7 * Update - Compatibility with LiteSpeed Quic Cloud IP addresses automatically * Fix - Litespeed cache plugin compatibility and set /cache/ls directory by default * Fix - Whitelist website IP address on REST API disable to be able to be accessed by the installed plugins = 8.0.19 = * Fix - Compatibility with LiteSpeed when CDN is not set * Fix - Change paths when www. prefix exists on the domain = 8.0.17 = * Update - Compatibility with WP Rocket Background CSS loader * Update - Compatibility with LiteSpeed Cache CDN * Update - Map Litespeed cache directory in URL Mapping * Fix - Remove dynamic CSS and JS when Text Mapping is switched off * Fix - Prevent changing wp-content and wp-includes paths in deep URL location and avoid 404 errors = 8.0.16 = * Update - Layouts, colors * Update - Added Drupal 11 in CMS simulation * Update - Set 404 Not Found error as default option for hidden paths * Fix - Compatibility with Wordfence Scan * Fix - Changed deprecated PHP functions * Fix - Warnings when domain schema is not identified for the current website * Fix - Redirect to homepage the newadmin when user is not logged in = 8.0.15 = * Fix - Compatibility with WP 6.6.2 * Fix - Compatibility with Squirrly SEO buffer when other cache plugins are active * Fix - Compatibility with Autoptimize minify = 8.0.14 = * Update - Added the option to select all Countries in Geo Blocking * Update - Brute Force compatibility with UsersWP plugin * Update whitelist path to not check Brute force reCaptcha in case of login whitelist paths = 8.0.13 = * Update - Added the option to disable Copy & Paste separately * Fix - PHP Error on HMWP_Models_Files due to the not found class * Fix - Layout, Typos, Small Bugs = 8.0.12 = * Update - Compatibility with Wordfence = 8.0.11 = * Update - Plugin security and compatibility with WP 6.6.1 & PHP 8.3 * Update - Adding wp-admin path extensions into firewall when user is not logged in = 8.0.10 = * Fix - Google reCaptcha on frontend popup to load google header if not already loaded * Fix - Hide New Login Path to allow redirects from custom paths: lost password, signup and disconnect * Fix - WP Multisite active plugins check to ignore inactive plugins * Fix - Small bugs = 8.0.09 = * Update - Add security preset loading options in Hide My WP > Restore * Fix - Library integrity on the update process * Fix - Cookie domain on WP multisite to redirect to new login path when changing sites from the network * Fix - Brute Force shortcode to work with different login forms = 8.0.07 = * Fix - Compatibility with WP 6.6 * Fix - Security update on wp-login.php and login.php = 8.0.06 = * Update - Compatibility with WordPress 6.5.5 * Update - Added the option to immediately block a wrong username in Brute Force * Update - Sub-option layouts * Fix - File Permission check to receive the correct permissions when is set stronger than required * Fix - Hide login.php URL when hide default login path * Fix - Small bugs = 8.0.05 = * Update - Added more path in Frontend Test to make sure the settings are okay before confirmation * Fix - Compatibility with Wordfence to not remove the rules from htaccess * Fix - Filter words in 8G Firewall that might be used in article slugs * Fix - Trim error in cookie when main domain cookie is set * Fix - Login header hooks to not remove custom login themes = 8.0.03 = * Fix - isPluginActive check error when is_plugin_active is not yet declared * Fix - Disable clicks and keys to work without jQuery * Fix - Compatibility with Wordfence scan process = 8.0.02 = * Fix - Show error messages in Temporary login when a user already exists * Fix - Temporary users to work on WP Multisite > Subsites = 8.0.01 = * Fix - Login security when Elementor login form is created and Brute Force is active * Fix - Login access when member plugins are used for login process * Fix - Firewall warning on preg_match bot check in firewall.php = 8.0.00 = * Update - Added Country Blocking & Geo Security feature * Update - Added Firewall blacklist by User Agent * Update - Added Firewall blacklist by Referrer * Update - Added Firewall blacklist by Hostname * Update - Added 'Send magic link login' option in All Users user row actions on Hide My WP Advanced Pack plugin * Update - Added the option to select the level of access for an IP address in whitelist * Removed - Mysql database permission check as WordPress 6.5 handles DB permissions more secure * Moved - Firewall section was moved to the main menu as includes more subsections * Fix - 8G Firewall compatibility with all page builder plugins
Copyright © WPPlugins