Search: firewall

… freelancer and developer activity across client sites. Multi-author blogs can monitor who publishes, edits, and deletes content. WooCommerce stores can track admin actions like product changes and order modifications. Any site that gives dashboard access to more than one person benefits from the accountability and auditability the Events Log provides.

Frequently Asked Questions

Is this a free or Premium feature?

The User Events Log is a WP Ghost Premium feature. The free version includes path security, firewall, brute force protection, and 2FA, but not event logging. The free version does include the last 20 entries in the Security Threats

… to its initial unconfigured state. The plugin remains installed but inactive. You can reconfigure from scratch or load a preset at any time. For more recovery options, see the Rollback Settings tutorial.

Deactivate and delete the plugin. Deactivating WP Ghost from the Plugins page instantly reverts every path change, removes firewall rules from .htaccess, and restores all WordPress defaults. Your login page goes back to , your admin returns to , and every plugin, theme, and asset path loads from its original location. Deleting the plugin afterward removes all WP Ghost data from the database. Your site is returned to its exact …

… WordPress and checks vulnerability databases for exploits matching your specific plugins and themes. Your existing security plugin blocks the exploit attempt when it arrives. WP Ghost prevents the bot from discovering what to exploit in the first place. Both layers matter.

What WP Ghost Adds to Any Existing Security Plugin

Regardless of which security plugin you currently use, WP Ghost adds these capabilities that the others typically do not provide: path security for over 30 WordPress paths including individual plugin and theme name randomization, the 7G/8G firewall operating at the server rewrite layer (complementing application-level firewalls), CMS simulation

… When you set up WP Ghost for security (by activating Safe Mode or Ghost Mode and changing your WordPress paths), you automatically hide from theme detectors as a side effect. The path changes that prevent bots from finding your plugins and themes also prevent detection tools from identifying them. The firewall, brute force protection, 2FA, and security headers add further protection layers. You do not need to choose between security and privacy. The security configuration gives you both.

For the complete security setup, see the WP Ghost Tutorial. For the recommended configuration, see the Best Practice guide.

Frequently Asked Questions …

… Google can detect WordPress or not makes zero difference to how your pages rank. Hiding your CMS is a security measure, not an SEO one.

Will hiding paths affect how Googlebot crawls my site?

No. WP Ghost automatically whitelists Googlebot, Bingbot, Yandex, and other legitimate search engine crawlers when the firewall is active. Crawlers access and index your site normally. The firewall and path changes only block malicious bot traffic and scanners. Your content, sitemaps, images, and all indexable resources remain fully accessible to search engines.

Will changing the sitemap or robots.txt affect rankings?

No. WP Ghost’s sitemap …

Yes. Hiding the WordPress login page is one of the most effective single steps you can take against automated brute force attacks. Bots target /wp-login.php and /wp-admin on every WordPress site because these paths are identical on every default installation. When WP Ghost changes the login path to a custom URL, bots scanning for the default path get a 404 error and move on. But hiding the login is only one layer. For real security, you need path changes for all WordPress paths, a firewall, brute force protection, and 2FA working together.

Why Hiding the Login Path …

Moved

This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.

View on new site

Yes. WP Ghost hides your WordPress identity from bots, scanners, and theme detectors by changing every default path, removing WordPress fingerprints from the source code, and blocking access to files that reveal your CMS. You can go from a fully detectable WordPress site to invisible in under three minutes using one-click security presets. No coding required.

Why Should I Hide My WordPress Site?

WordPress powers over 40% of all websites, which makes it the most targeted …

… It also includes a 7G/8G firewall, brute force protection with reCAPTCHA, 2FA with passkeys, security headers, and country blocking (Premium). Together, these features provide comprehensive hack prevention. For sites that also need malware scanning, pair WP Ghost with a scanning plugin or managed hosting. See the compatible plugins list.

Does WP Ghost modify WordPress core files?

No. All changes are applied through server rewrite rules and WordPress filters at runtime. No files are renamed, moved, or modified. Deactivating WP Ghost restores every default path and fingerprint instantly.

… Should I Install WP Ghost?

Install WP Ghost during the development phase, before your site goes public. Here’s why: bots start scanning your domain the moment it resolves to a server, even during development. If your site runs on a live server (not localhost), bots can find your default WordPress paths, probe for vulnerabilities, and attempt brute force attacks before you’ve even published your first page.

Installing WP Ghost during development means your site launches with path security, firewall, and brute force protection already configured. You don’t have to scramble to add security after going live …

… browser to confirm everything works. For the complete AJAX configuration guide, see the Change admin-ajax.php Path tutorial.

Compatibility Notes

Most plugins and themes work seamlessly with a custom admin-ajax.php path because WP Ghost handles the URL rewriting at the server level. However, a few plugins hardcode the default admin-ajax.php path instead of using WordPress’s function. If a specific feature stops working after changing the AJAX path, that plugin likely hardcodes the URL.

In that case, you have two options: revert the AJAX path to the default in WP Ghost while keeping all …

… need to add and before the “stop editing” line.

The drawbacks of the manual approach: it only changes the folder name (it doesn’t hide the old path or block access to it), it requires editing a critical config file (a typo can break your site), some plugins hardcode and may break, it doesn’t change sub-paths like or , and it doesn’t provide any firewall, brute force, or other security features.

WP Ghost handles all of this automatically, changes all sub-paths too, and adds layered security on top. If you deactivate WP Ghost, everything reverts instantly …