Ghost Doctor

This guide is for anyone who has changed WordPress paths with WP Ghost and wants to know their site still works, and for anyone who pressed Start Diagnosis and wondered how much it actually does.

TL;DR: Ghost Doctor is WP Ghost’s self-check and repair tool. It visits your renamed paths the way a real visitor would, reads your server and active plugins, and tells you whether the layout, theme files, admin-ajax, and the REST API are being served. When a path breaks it repairs the cheapest safe thing first, keeps your security where it can, and undoes anything that did not help. It can also ask AI to explain your Security Check findings in plain words.

What you get from Ghost Doctor

Ghost Doctor lives on the Level of Security page in WP Ghost. Press Start Diagnosis and it runs a live check against your own site, then reports back in plain words. Either “Every check passed. Your website paths are working,” or a list of what broke and the repairs it can apply. One button does three jobs: it diagnoses, it repairs, and it explains.

Most path tools stop at “the file exists.” Ghost Doctor goes further. It loads your pages as a logged-out visitor, reads which server and cache plugin you run, and matches its repairs to that setup. A security change should never be the reason your site goes down, and when something does slip, you should be able to fix it from the plugin instead of opening a support ticket.

Why a security plugin needs a doctor

WP Ghost changes more than 30 default WordPress paths: wp-admin, the login URL, the REST API, the uploads folder, admin-ajax, the plugins directory, and others. On Apache and LiteSpeed those changes go into .htaccess. On nginx you add the generated config once.

Most of the time this just works. Servers are not identical, though. A host can ignore .htaccess. A cache plugin can hold an old copy of a page with the old paths baked in. A rule that works on one stack returns a 404 on another. When that happens a renamed path stops resolving, the theme can lose its CSS, and part of the site looks broken to visitors while the admin still looks fine to you.

That is the failure Ghost Doctor is built to catch, before your visitors do.

What it checks

Ghost Doctor runs a frontend probe against the paths that decide whether a site works:

• The homepage renders. It confirms the page draws its real layout, so a blank or half-built page is caught, not only a bare 200 response.
• Your theme’s CSS and JavaScript load. A page that loads but has lost its styling is a broken page, and this is where that shows up.
• admin-ajax answers. This is the address page builders, contact forms, and WooCommerce send their save and update requests to.
• The REST API answers. The block editor and many plugins depend on it.
• The renamed admin path and your logo asset resolve. A check that the rewrite rules reach real files on disk.

Each check is made with a one-time preview token that switches off WP Ghost’s own PHP fallback, so only your server’s rewrite rules answer. Without that token, WP Ghost could serve the file itself and hide a broken server rule. The token keeps the test honest. A path that answers only because the plugin caught it is reported as a path your server is not serving.

It reads your setup first

Before it suggests a single repair, Ghost Doctor reads the parts of your setup that decide which repair makes sense:

• Your server. Apache, nginx, IIS, or CloudPanel, and whether its config file is writable.
• Whether the rules are actually written into the server config, or only stored in the plugin.
• Your cache plugin. It detects an active cache layer, because a cache plugin that saved the old paths is one of the most common reasons a path breaks.
• Your current security mode and how many paths you have mapped.

This is what keeps the repairs grounded. A fix that only applies to a cache plugin is skipped on a site that has none. A setting already at the right value is left alone. The diagnosis is shaped by the site in front of it.

How it repairs: security first, then functionality

A diagnosis that only told you something is wrong would be half a tool. When Ghost Doctor finds a broken path, it works through a fixed list of repairs, from the cheapest and safest to the most drastic. It applies one, checks the result, and keeps it only if it helped:

1. Serve the theme files through WordPress. For the common case where a cache plugin saved the old asset paths. Your layout comes back at once; the files load a little slower until the cache rebuilds.
2. Open admin-ajax for editors and builders. For when a page builder cannot reach the hidden ajax address.
3. Put the custom admin-ajax or REST path back. One path returns to its standard value because your server will not serve the custom one, and the other 30 stay hidden.
4. Fall back to the Minimal preset. A last resort, reached only when a server will not serve the rewrites at all. Minimal keeps every protection that needs no server rules and drops the ones that do, so your site works while you sort the server out.

Two things make this safe. Every repair writes a snapshot before it runs, so one click undoes the whole session from the Keep Changes or Undo All Changes buttons. And the order is deliberate: it gives back the least security needed to make the site work again. You are never dropped to Minimal because one asset returned a 404.

It explains your findings in plain words

Ghost Doctor reaches past paths. From the same screen it can send your current Security Check findings to the WP Ghost account service and get back a plain-language explanation, ranked by what to handle first. You get what each finding means and why it matters on your site.

The explanation is tied to your findings, so it refreshes on its own when a scan turns up something different. An active subscription includes a set number of AI explanations a month, and the number left shows on the button. The diagnosis and the repairs work with or without it.

When Ghost Doctor is the right tool

• Right after you change paths or switch to Ghost Mode. Run it once to confirm the new setup holds on your server.
• After a host move or a PHP or server upgrade. A new environment can read .htaccess differently; a quick diagnosis tells you if anything slipped.
• When a visitor reports a broken page you cannot reproduce while logged in. Ghost Doctor tests as a logged-out visitor, which is where path breaks show up.

Ghost Doctor checks paths and repairs configuration. It does not scan for malware. For a site you think is already infected, pair WP Ghost with a scanner.

How to run it

Open WP Ghost, go to Level of Security, and press Start Diagnosis. The check takes a few seconds. If everything passes, you are done. If something failed, Ghost Doctor lists each issue with the repair it can apply, and you choose whether to let it. After any repair, clear your cache, since a stale cached page is one of the few things a diagnosis cannot fix for you. For that case, see Change Paths in Cached Files.

FAQ

My theme lost its CSS after I hid the paths. What happened?

Your server or your cache is serving the old asset paths. Run Ghost Doctor: it will find the failing theme files and, in most cases, serve them through WordPress so the layout comes back while you clear the cache. The usual root cause is a cache plugin holding pages built with the old paths.

What does “Every check passed” actually mean?

It means your server is serving every renamed path WP Ghost created, a logged-out visitor gets a working site, and your theme’s styles and scripts load. It is a live test, not a saved status: Ghost Doctor fetched each path at that moment and got a real answer.

Ghost Doctor says a path is failing. Is my site hacked?

No. A failing path is almost always a server configuration issue, not an attack. The usual cause is a server that ignores .htaccess, or a cache serving an old page. Ghost Doctor will tell you which path and, in most cases, repair it. For the Apache case, see make sure Apache reads .htaccess.

My page builder stopped saving after I hid admin-ajax. Can Ghost Doctor fix it?

Yes. That is one of the repairs it runs: it reopens admin-ajax for editors and builders, or puts the ajax address back to the standard one if your server will not serve the hidden version, while the rest of your paths stay hidden.

Will Ghost Doctor change my settings without asking?

It applies a repair when you run a diagnosis and accept it, and it reverts any repair that did not help. Every run is saved as a snapshot, so Undo All Changes puts everything back. It will not rewrite your configuration on its own in the background.

Does Ghost Doctor work on nginx?

Yes, the checks run the same. It detects nginx and tailors its repairs to it. Remember that on nginx, path changes need the generated config added to the server once; if a path fails, that is the first thing to confirm.

How often should I run it?

After any change to paths, to your host, or to your server, and any time a page looks wrong to a visitor. On a stable site that has not changed, there is no need to run it on a schedule.

If you have changed paths and never pressed Start Diagnosis, open WP Ghost and run it once now. WP Ghost has a free version on wordpress.org if you want to try the whole workflow first.