{"id":627,"date":"2025-06-16T09:35:14","date_gmt":"2025-06-16T07:35:14","guid":{"rendered":"https:\/\/wpcodebox.com\/?post_type=tutorial&p=627"},"modified":"2025-12-15T17:26:11","modified_gmt":"2025-12-15T16:26:11","slug":"remove-wordpress-version-number","status":"publish","type":"tutorial","link":"https:\/\/wpcodebox.com\/tutorial\/remove-wordpress-version-number\/","title":{"rendered":"Remove the WordPress Version Number with One Simple Code Snippet!"},"content":{"rendered":"\n

By default, WordPress shares the exact version number in your site’s source code. If you are on a version known to have a vulnerability, attackers can exploit it to compromise your site.<\/p>\n\n\n\n

In this article, I’ll share with you how to remove the WordPress version number from all visible locations.<\/p>\n\n\n\n

Why You Should Remove the WordPress Version Number<\/h2>\n\n\n\n

Your WordPress version number publicly reveals which release your site runs. For example, when security researchers disclose an exploit for a specific version of WordPress, automated tools immediately search for sites running that exact version. The visible WordPress version tag on your website acts as a beacon, telling attackers your site is potentially vulnerable.<\/p>\n\n\n\n

This creates a dangerous window of exposure between patch release and your update. Even a day of delay gives scanners time to find and compromise your installation.<\/p>\n\n\n\n

Where Does WordPress Expose Your Version?<\/h2>\n\n\n\n

Your WordPress version appears in three primary locations across your site.<\/p>\n\n\n\n

The HTML head section displays a generator meta tag. WordPress automatically outputs <meta name=”generator” content=”WordPress X.X.X” \/> in your source code. Most automated scanners check this first.<\/p>\n\n\n\n

\"wordpress<\/a><\/figure>\n\n\n\n

RSS feeds include the version number in their metadata. The same generator tag that appears in your header also outputs in feeds, creating another exposure point.<\/p>\n\n\n\n

\"wordpress<\/a><\/figure>\n\n\n\n

CSS and JavaScript files reveal the version through query strings. Your source code shows files like style.css?ver=X.X.X. Attackers inspect these parameters to fingerprint your exact WordPress release.<\/p>\n\n\n\n

\"worpress<\/a><\/figure>\n\n\n\n

Each location gives attackers a way to identify your installation and carry out attacks.<\/p>\n\n\n\n

How to Remove WordPress Version Number<\/h2>\n\n\n\n

Basic solutions only remove the header generator tag. This leaves your version exposed in RSS feeds and asset URLs. You need a comprehensive approach that addresses all three locations simultaneously.<\/p>\n\n\n\n

This code snippet removes the WordPress version from all public locations. It hides the generator tag in headers and RSS feeds. It also strips version numbers from CSS and JavaScript file queries.<\/p>\n\n\n\n

<?php\n\nadd_filter('the_generator','__return_empty_string');\n\nfunction remove_version_from_assets($src) {\n    $wp_version = get_bloginfo('version');\n\n    if(strpos($src,'ver='.$wp_version) !== false) {\n        $src = remove_query_arg('ver',$src);\n    }\n\n    return $src;\n}\nadd_filter('style_loader_src','remove_version_from_assets',9999); \nadd_filter('script_loader_src','remove_version_from_assets',9999);<\/code><\/pre><\/div>\n\n\n\n
The first line uses a WordPress helper function to return an empty string for all generator tags. The second function specifically targets version parameters matching your current WordPress release. It leaves other query strings intact to avoid breaking cache-busting strategies for custom themes and plugins. The 9999 priority ensures this filter runs after most other processes, catching all cases.<\/p>\n\n\n\n
Both filters work together to provide complete coverage. When automated scanners look for generator tags, they\u2019ll find nothing. Tools inspecting your asset URLs will see query strings without version data.<\/p>\n\n\n\n
Step-by-Step: Add This Code Snippet to Your WordPress Website<\/h3>\n\n\n\n
Editing theme files directly creates long-term problems. Theme updates can overwrite your custom code and force you to reapply changes. A syntax error can lock you out of your admin area completely. A better solution is to use a code snippet plugin.<\/p>\n\n\n\n
WPCodeBox<\/a> eliminates these risks by running your code snippets independently of your theme. The plugin isolates custom code in a protected environment with built-in error handling that prevents most mistakes from breaking your site. Your modifications stay active across theme changes and updates without manual intervention.<\/p>\n\n\n\n
\"wpcodebox<\/a><\/figure>\n\n\n\n
The plugin also provides a library of verified snippets you can add with one click, plus cloud sync to reuse your solutions across all your WordPress sites. You manage all PHP, CSS, and JavaScript snippets from an organized dashboard that keeps your code portable and maintenance-free.<\/p>\n\n\n\n
Let\u2019s now look at how to use it to hide the WordPress version:<\/p>\n\n\n\n
    \n
  1. Start by purchasing and installing WPCodeBox on your site. Once activated, navigate to WPCodeBox from your admin menu.<\/li>\n\n\n\n
  2. This automatically opens a new snippet creation window. Name your snippet “Remove WordPress Version Number” for easy reference. You can also add a brief description if you want.<\/li>\n\n\n\n
  3. Paste the complete PHP code from the previous section into the code editor.<\/li>\n\n\n\n
  4. Configure these settings in the snippet panel:\n