Search: error

… original paths even after you change the uploads directory. Google can still reach already-indexed images through the old URLs. New references in your page source use the custom paths, and Google indexes those as it recrawls your site.

If you enable Hide WordPress Common Paths with media files included, WP Ghost redirects old image URLs to the new paths automatically. Google follows the redirect, consolidates to the new URL, and your image SEO authority transfers cleanly. No 404 errors, no broken links, no duplicate content. For details, see the redirect images from old paths guide.

After making path changes,

Yes. Hiding the WordPress login page is one of the most effective single steps you can take against automated brute force attacks. Bots target /wp-login.php and /wp-admin on every WordPress site because these paths are identical on every default installation. When WP Ghost changes the login path to a custom URL, bots scanning for the default path get a 404 error and move on. But hiding the login is only one layer. For real security, you need path changes for all WordPress paths, a firewall, brute force protection, and 2FA working together.

Why Hiding the Login Path …

… the new URLs, but the server knows to serve them from the original locations. Functionality is completely unaffected.

Does this also hide plugins from vulnerability scanners like WPScan?

Yes. Vulnerability scanners like WPScan detect plugins by probing known paths (like ). When WP Ghost changes these paths, the scanner gets 404 errors for every probe and reports zero detected plugins. This is the security benefit: bots cannot find plugins to check against vulnerability databases.

Is this a free feature?

Changing the plugins directory path and randomizing plugin names are included in the free version of WP Ghost. Text Mapping for replacing

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

Go to WP Ghost > Change Paths > Ajax Security, set a custom name in the Custom admin-ajax.php Path field, and click Save. WP Ghost replaces the default URL with your custom path across the entire frontend. The default path returns a 404 error for bots while all legitimate AJAX calls route through the new URL transparently.

Why Changing admin-ajax.php Matters

The file is one of the most targeted endpoints in WordPress. Every AJAX request …

… the Login Path with WP Ghost?

Go to WP Ghost > Change Paths > Login Security. Enter your custom name in the Custom Login Path field. For example, instead of you could use or any name that’s not easily guessable. Click Save.

After saving, the old , , and paths return a 404 error for non-logged-in visitors. Only your custom URL reaches the login form. Bookmark your new login URL immediately, as the default paths will no longer work.

WP Ghost does not physically change any files on your server. It uses rewrite rules to route requests from the new URL …

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

Yes. Go to WP Ghost > Change Paths > Admin Security and enter your custom name in the Custom Admin Path field. Click Save. WP Ghost replaces with your custom path using server rewrite rules. The actual wp-admin directory is not renamed or moved. Bots scanning for the default get a 404 error, while you access the dashboard through the new URL.

Why Changing wp-admin Matters

The directory is the single most recognizable WordPress path. Every WordPress …

… deactivate WP Ghost or if another plugin depends on the default admin path.

How WP Ghost Handles the Admin Path

WP Ghost’s path security is designed to block unauthenticated access, not authenticated access. When a bot or non-logged-in visitor tries to access , WP Ghost returns a 404 error or redirects them to a page you specify. The bot cannot confirm WordPress and moves on. When you are logged in as an administrator and visit , WP Ghost recognizes your authenticated session and lets you through. Your custom admin path also works, giving you two ways to reach the …

… not through FTP. They scan for , , and by sending web requests. WP Ghost makes these paths return 404 errors or redirect to custom URLs at the HTTP level, which is where the attacks happen. The actual file locations on the server are irrelevant to bots because they cannot access your FTP. This is why virtual path changes are just as effective as physically moving files, without any of the risks or complexity that file-level changes would introduce.

Frequently Asked Questions

Can I still use FTP to edit theme files with WP Ghost active?

Yes. Your theme files are …

… , and your server sends the pingback traffic to the target site. Thousands of WordPress sites can be coordinated this way to create a distributed denial-of-service attack, and your server’s resources are consumed in the process.

How to Disable XML-RPC in WP Ghost

Go to WP Ghost > Change Paths > API Security and switch on Disable XML-RPC Access. Click Save. Requests to will return an error, and the two attack vectors described above are eliminated. For the full XML-RPC configuration guide, see the Disable XML-RPC tutorial.

If You Need to Keep XML-RPC Enabled …