WordPress and plugin version numbers are publicly visible, aiding attackers.
Exposed Version Numbers in Source Code
Key Points: Theme, plugin, and core version numbers in your site’s HTML can tip off attackers to known vulnerabilities.
View source, find ?ver=5.9.3 — and boom, the attacker knows exactly what exploit to run. Don’t make it easy for them.
🔓 Why It’s Dangerous
- Automated bots look for known versions with known flaws
- Version numbers appear in scripts, styles, and meta tags
- Attackers match versions to vulnerabilities in public databases
🛠️ How to Hide Them
- Remove WordPress version with
remove_action('wp_head', 'wp_generator') - Deregister styles/scripts that append
?ver=manually - Use a security plugin to clean metadata automatically
📌 Reminder
Obscurity isn’t security — but removing obvious clues helps delay automated attacks.