WP Ghost Preset Security Options – One-Click WordPress Security Configuration

Load a tested security configuration in one click with WP Ghost’s (formerly Hide My WP Ghost) security presets. WP Ghost Premium offers four presets, from Minimal (no server config changes) to Ghost Mode with the 2026 Ghost Firewall, brute force protection and logging. The free version has three presets.

Configuring security from scratch means navigating through multiple settings pages and toggling dozens of options. WP Ghost’s security presets eliminate this by offering four pre-configured bundles that you can load with a single click. Each preset activates a specific combination of path security level, firewall rules, brute force protection, logging, and two-factor authentication. Load a preset, customize your login path, and your site’s hack prevention is configured in under a minute.

Every preset has been tested across different server environments and plugin combinations. They are a starting point, not a final destination. After loading one, you can fine-tune individual settings for your specific site.

The four preset options

Minimal (No Config Rewrites)

Best for: Restrictive hosting environments that do not allow .htaccess or Nginx config modifications.

This preset applies basic security measures without writing any server configuration files. It changes the wp-login.php path to a custom URL but does not modify .htaccess or server config. Use this when your hosting prevents config file changes, or when you want the lightest possible WP Ghost setup.

What it enables: custom login path (/newlogin), the Medium firewall level, brute force protection with Math reCAPTCHA and basic hardening such as hiding version numbers. No logging.

Safe Mode + Firewall + compatibility

Best for: Sites running WooCommerce, Elementor, caching plugins, or other popular plugins where compatibility matters.

This preset activates Safe Mode path changes with medium-level firewall protection and includes compatibility settings tested with popular plugins. It is the recommended starting point for most sites because it provides meaningful protection while minimizing the risk of plugin conflicts.

What it enables: Safe Mode custom paths, medium firewall protection, plugin compatibility settings.

Safe Mode + full protection

Best for: Sites that want brute force, 2FA and logging on top of Safe Mode’s balanced path changes.

This preset enables Safe Mode paths plus the Medium firewall level, brute force protection with Math reCAPTCHA on the login, lost password, sign up and comment forms, the User Events Log and the Security Threats Log. Its name also lists two-factor authentication: after loading it, check WP Ghost > 2FA Login and switch 2FA on if it’s off. It is the full security stack without Ghost Mode’s aggressive path changes.

What it enables: Safe Mode custom paths, Medium firewall, brute force with Math reCAPTCHA, Events Log, Threats Log.

Ghost Mode + full protection

Best for: Maximum security when you want the most aggressive path changes and every protection feature active.

This preset enables Ghost Mode’s advanced path changes (all WordPress paths including plugins, themes, wp-includes, and more) plus the 2026 Ghost Firewall, brute force with Math reCAPTCHA, Events Log, Threats Log, and 2FA. This is the highest level of protection WP Ghost offers as a one-click configuration, and it’s available in WP Ghost Premium.

What it enables: Ghost Mode custom paths, 2026 Ghost Firewall, brute force with Math reCAPTCHA, Events Log, Threats Log, 2FA.

How to load a preset

Go to WP Ghost > Change Paths. Choose the preset you want in Select Preset. Click Load Preset and confirm the action. WP Ghost applies all preset settings and saves automatically.

After loading, verify your site is working by opening an incognito browser and navigating to your homepage and a few internal pages. If anything looks wrong, use the rollback settings to revert.

Customize login paths after loading

Each preset sets a default login path: /newlogin for Safe Mode presets, /ghost-login for Ghost Mode. These are generic defaults that many WP Ghost users share. For better security, change the login path to something unique to your site.

Go to WP Ghost > Change Paths > Login Security. Enter your custom path in the Custom Login Path field. Click Save and bookmark your new login URL immediately.

After changing the login path, the default /wp-login.php and /wp-admin are no longer accessible to visitors. If you forget your custom path, use the emergency disable guide for recovery.

Backup and restore settings

Before loading any preset, create a backup of your current configuration. Go to WP Ghost > Backup/Restore. Click Backup Settings and the backup file downloads to your computer. To restore it later, upload that file under Restore Settings and click Restore Backup.

Troubleshooting

Site breaks after loading a preset

Some presets modify server configuration files (.htaccess on Apache, config files on Nginx). If your server does not support the required rules, pages may return 404 or 500 errors. Use the emergency disable guide, the rollback settings, or add a constant in wp-config.php to disable WP Ghost temporarily. Then try a lower-level preset (start with Minimal or Safe + Compatibility). On WP Ghost Premium 9.0.13 or later, press Start Diagnosis in Ghost Doctor on the Level of Security page. It finds which path your server stopped serving and repairs it, or switches to protection that needs no server rules.

Cannot find the login page after loading a preset

The preset changed your login path. Try /newlogin for Safe Mode presets and /ghost-login for Ghost Mode. If neither works, use the Safe URL parameter or the emergency disable guide to regain access.

Plugin conflicts after loading a preset

The Compatibility preset covers the most common plugins, but edge cases exist. Check the Compatibility Plugins List for known issues. If a conflict persists, start with the Minimal preset and add features one by one to isolate the issue.

Frequently asked questions

Which preset should I choose?

Start with Safe Mode + Firewall + Compatibility for most sites. It provides meaningful protection with the lowest risk of plugin conflicts. If you need full protection (brute force, 2FA, logging), try Safe Mode + Full Protection. Only use Ghost Mode + Full Protection if you are comfortable with aggressive path changes and have verified compatibility with your plugins.

Can I customize settings after loading a preset?

Yes. Presets are a starting point. After loading, every setting is individually adjustable. You can change paths, switch reCAPTCHA types, add geo blocking, modify firewall rules, or toggle any feature on or off.

Will loading a preset delete my current settings?

Yes. Loading a preset overwrites all current WP Ghost settings. Always create a backup before loading a preset if you want to preserve your current configuration.

Does this work with WooCommerce?

Yes. The Safe Mode + Firewall + Compatibility preset specifically includes settings tested with WooCommerce. The other presets are also compatible but may need individual adjustments for checkout or cart pages.

Does WP Ghost modify WordPress core files?

No. Presets configure WP Ghost settings stored in the WordPress options table. Some presets write server config rules (.htaccess) but no WordPress core files are modified.

Related tutorials

Continue configuring after loading a preset:

Customize All WordPress Paths – fine-tune individual path settings after loading a preset.

Brute Force Attack Protection – switch from Math reCAPTCHA to Google V2, V3, or Enterprise.

Firewall and Geo Security – upgrade from medium to 2026 Ghost Firewall, add country blocking.

Two-Factor Authentication – configure 2FA method (code, email, or passkey).

Advanced WP Security – rollback settings, server compatibility, and plugin loading.

Website Security Check – verify your configuration after loading a preset.

Safe Mode vs Ghost Mode – understand the difference between the two security levels.