How to Change wp-content Path with Hide My WP Ghost Plugin
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
Change and hide the WordPress wp-content path with WP Ghost (formerly Hide My WP Ghost) to remove the most visible WordPress directory from your source code. The /wp-content/ path is the parent directory for all your themes, plugins, uploads, and media. It appears in every CSS, JavaScript, and image URL on your site. Change it once, and every reference updates automatically.
The wp-content directory is the center of your WordPress installation. It contains plugins, themes, uploaded media, and custom code. Every asset your site loads references this directory in the page source. Vulnerability scanners like WPScan probe /wp-content/plugins/ to enumerate your plugins, and theme detectors check /wp-content/themes/ to identify your CMS. Changing this single path removes the most prominent WordPress fingerprint from your entire site.
Why You Need to Secure the wp-content Path
| Default /wp-content/ (exposed) | With WP Ghost (secured) |
|---|---|
| Every CSS, JS, and image URL reveals it | Custom name, zero WordPress references |
| WPScan enumerates plugins via /wp-content/plugins/ | Scanner cannot find the directory |
| Theme detectors confirm CMS instantly | CMS detection fails |
| readme.txt files reveal plugin versions | Old path blocked, version files return 404 |
How to Secure wp-content with WP Ghost
Activate Safe Mode or Ghost Mode
Go to WP Ghost > Change Paths > Level of Security. Select Safe Mode or Ghost Mode and click Save. Both modes change the wp-content path automatically with a predefined name.
Change the wp-content Path
This replaces every reference to /wp-content/ in your page source with a custom name. Images, CSS, JavaScript, fonts, and every other asset URL that references wp-content will show the new path instead.
Go to WP Ghost > Change Paths > WP Core Security. Find the Custom wp-content Path field. A predefined name is already filled in. Enter a different name or keep the predefined one. Click Save.
Avoid names that obviously relate to content, like “content”, “assets”, “files”, or “resources”. Choose something random that does not suggest what is inside.
No files are moved
WP Ghost does not physically move or rename any files. The wp-content folder stays exactly where it is. WP Ghost uses URL rewrite rules to create the virtual path. Deactivating restores all defaults instantly.
Hide the Old wp-content Path
Changing the path gives you a new URL, but the original /wp-content/ might still respond to direct requests. The Hide WordPress Common Paths option blocks this. Anyone accessing the old path gets a 404 error.
Go to WP Ghost > Change Paths > WP Core Security. Switch on Hide WordPress Common Paths. Under Hide File Extensions, select file types to block from the old paths. The key ones are: PHP (blocks direct access to vulnerable plugin files), JS (hides JavaScript files that reveal plugin structure), and TXT (hides readme.txt files that expose plugin versions). Click Save.
Hiding TXT files is especially effective. With this enabled, bots trying to access /wp-content/plugins/plugin-name/readme.txt get a 404 instead of a file that reveals the exact plugin version.
Verify with a Security Check
Go to WP Ghost > Security Check. Click Start Scan. The scan confirms the wp-content path is changed and the old path is hidden.
For a quick manual test, open a private browser window, view your page source (Ctrl+U), and search for “wp-content”. If the change is working, you will not find any matches.
Troubleshooting
If your site breaks or media files stop displaying after changing the path:
Clear all caches. Clear your browser cache, WordPress caching plugin, CDN cache, and server-level cache. Cached pages contain old wp-content references. If your caching plugin minifies CSS and JS, also enable Change Paths in Cached Files in WP Ghost > Tweaks.
Revert to the predefined name. Remove your custom name and use the predefined one that WP Ghost suggests. Save and test.
Check CDN configuration. If you use a CDN, it may need to know about the new path. Add your CDN domain in WP Ghost > Mapping > CDN URLs for automatic path mapping.
Check plugin compatibility. Some plugins hardcode /wp-content/ paths. Deactivate plugins one by one to identify the conflict. Check the Compatibility Plugins List.
Use the Safe URL. If you cannot access the dashboard, use the Safe URL parameter or the Emergency Disable guide.
Frequently Asked Questions
Will changing the wp-content path break my site?
No. All themes, plugins, and media continue working normally. WP Ghost uses rewrite rules that transparently serve files from the original wp-content directory through the new URL. Nothing changes for visitors or your admin experience.
What is the difference between wp-content and wp-includes?
wp-content holds your customizations: themes, plugins, and uploaded media. wp-includes holds the WordPress core library: jQuery, the editor, REST API framework, and core PHP classes. Both directories are WordPress fingerprints and both should be renamed for complete CMS hiding. See the Change wp-includes Path tutorial.
Do I need to clear my cache after changing this path?
Yes. Clear all caching layers. Cached pages still contain the old wp-content references until refreshed. If your caching plugin minifies CSS and JS, also enable Change Paths in Cached Files in WP Ghost.
Does this work with CDNs?
Yes, but you may need to update your CDN configuration. Add your CDN domain in WP Ghost > Mapping > CDN URLs for automatic path mapping. Most CDNs like Cloudflare, BunnyCDN, and KeyCDN handle this through origin pull rules.
Does WP Ghost physically move the wp-content folder?
No. WP Ghost never moves, renames, or modifies any file or folder. The wp-content directory stays where WordPress installed it. Virtual paths are created through URL rewrite rules. Deactivating WP Ghost restores all original paths instantly.
Related Tutorials
Change the wp-includes Path – hide the other core directory fingerprint.
Change the Plugins Path – rename the /plugins/ subdirectory and hide plugin names.
Customize All WordPress Paths – change every path in one guide.
URL Mapping and Text Mapping – change remaining class names and URLs in source code.
Website Security Check – verify your configuration after making changes.
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
Change and hide the WordPress wp-content path with WP Ghost (formerly Hide My WP Ghost) to remove the most visible WordPress directory from your source code. The /wp-content/ path is the parent directory for all your themes, plugins, uploads, and media. It appears in every CSS, JavaScript, and image URL on your site. Change it once, and every reference updates automatically.
The wp-content directory is the center of your WordPress installation. It contains plugins, themes, uploaded media, and custom code. Every asset your site loads references this directory in the page source. Vulnerability scanners like WPScan probe /wp-content/plugins/ to enumerate your plugins, and theme detectors check /wp-content/themes/ to identify your CMS. Changing this single path removes the most prominent WordPress fingerprint from your entire site.
Why You Need to Secure the wp-content Path
| Default /wp-content/ (exposed) | With WP Ghost (secured) |
|---|---|
| Every CSS, JS, and image URL reveals it | Custom name, zero WordPress references |
| WPScan enumerates plugins via /wp-content/plugins/ | Scanner cannot find the directory |
| Theme detectors confirm CMS instantly | CMS detection fails |
| readme.txt files reveal plugin versions | Old path blocked, version files return 404 |
How to Secure wp-content with WP Ghost
Activate Safe Mode or Ghost Mode
Go to WP Ghost > Change Paths > Level of Security. Select Safe Mode or Ghost Mode and click Save. Both modes change the wp-content path automatically with a predefined name.
Change the wp-content Path
This replaces every reference to /wp-content/ in your page source with a custom name. Images, CSS, JavaScript, fonts, and every other asset URL that references wp-content will show the new path instead.
Go to WP Ghost > Change Paths > WP Core Security. Find the Custom wp-content Path field. A predefined name is already filled in. Enter a different name or keep the predefined one. Click Save.
Avoid names that obviously relate to content, like “content”, “assets”, “files”, or “resources”. Choose something random that does not suggest what is inside.
No files are moved
WP Ghost does not physically move or rename any files. The wp-content folder stays exactly where it is. WP Ghost uses URL rewrite rules to create the virtual path. Deactivating restores all defaults instantly.
Hide the Old wp-content Path
Changing the path gives you a new URL, but the original /wp-content/ might still respond to direct requests. The Hide WordPress Common Paths option blocks this. Anyone accessing the old path gets a 404 error.
Go to WP Ghost > Change Paths > WP Core Security. Switch on Hide WordPress Common Paths. Under Hide File Extensions, select file types to block from the old paths. The key ones are: PHP (blocks direct access to vulnerable plugin files), JS (hides JavaScript files that reveal plugin structure), and TXT (hides readme.txt files that expose plugin versions). Click Save.
Hiding TXT files is especially effective. With this enabled, bots trying to access /wp-content/plugins/plugin-name/readme.txt get a 404 instead of a file that reveals the exact plugin version.
Verify with a Security Check
Go to WP Ghost > Security Check. Click Start Scan. The scan confirms the wp-content path is changed and the old path is hidden.
For a quick manual test, open a private browser window, view your page source (Ctrl+U), and search for “wp-content”. If the change is working, you will not find any matches.
Troubleshooting
If your site breaks or media files stop displaying after changing the path:
Clear all caches. Clear your browser cache, WordPress caching plugin, CDN cache, and server-level cache. Cached pages contain old wp-content references. If your caching plugin minifies CSS and JS, also enable Change Paths in Cached Files in WP Ghost > Tweaks.
Revert to the predefined name. Remove your custom name and use the predefined one that WP Ghost suggests. Save and test.
Check CDN configuration. If you use a CDN, it may need to know about the new path. Add your CDN domain in WP Ghost > Mapping > CDN URLs for automatic path mapping.
Check plugin compatibility. Some plugins hardcode /wp-content/ paths. Deactivate plugins one by one to identify the conflict. Check the Compatibility Plugins List.
Use the Safe URL. If you cannot access the dashboard, use the Safe URL parameter or the Emergency Disable guide.
Frequently Asked Questions
Will changing the wp-content path break my site?
No. All themes, plugins, and media continue working normally. WP Ghost uses rewrite rules that transparently serve files from the original wp-content directory through the new URL. Nothing changes for visitors or your admin experience.
What is the difference between wp-content and wp-includes?
wp-content holds your customizations: themes, plugins, and uploaded media. wp-includes holds the WordPress core library: jQuery, the editor, REST API framework, and core PHP classes. Both directories are WordPress fingerprints and both should be renamed for complete CMS hiding. See the Change wp-includes Path tutorial.
Do I need to clear my cache after changing this path?
Yes. Clear all caching layers. Cached pages still contain the old wp-content references until refreshed. If your caching plugin minifies CSS and JS, also enable Change Paths in Cached Files in WP Ghost.
Does this work with CDNs?
Yes, but you may need to update your CDN configuration. Add your CDN domain in WP Ghost > Mapping > CDN URLs for automatic path mapping. Most CDNs like Cloudflare, BunnyCDN, and KeyCDN handle this through origin pull rules.
Does WP Ghost physically move the wp-content folder?
No. WP Ghost never moves, renames, or modifies any file or folder. The wp-content directory stays where WordPress installed it. Virtual paths are created through URL rewrite rules. Deactivating WP Ghost restores all original paths instantly.
Related Tutorials
Change the wp-includes Path – hide the other core directory fingerprint.
Change the Plugins Path – rename the /plugins/ subdirectory and hide plugin names.
Customize All WordPress Paths – change every path in one guide.
URL Mapping and Text Mapping – change remaining class names and URLs in source code.
Website Security Check – verify your configuration after making changes.