WordPress Tip: Always Remove the WordPress Version Code

But then again.. if someone really wanted to hackyour WordPress site, they could easily figure it out thru other investigative ways that you run a WordPress site couldn’t they.

The point is that they won’t know what version you are running and so they have a harder time trying out known exploits for that version.

I know, but all I am saying if a real hacker wanted to, he could .. regardless. Either way, best solution to me is to still try and update asap!

I did both: Updated WP and removed the code. Thanks for the tip, I found it useful.

Very useful tip thank you

Short separation examples:
WP 2.3.3 and less  -> missing HTTP header field X-Pingback
WP 2.5.x -> request files from wp-include/text directly return status 404
WP 2.6 -> request files from wp-include/text directly return status 200
I think, cloaking the version is useless, because those outside, who want’s to know your version, do have any time to figure out a better separation strategy as shown above. So version could be always detected somehow.

Usefull tip Kyle, but it doesnt look like you follow your own advice. A look at your page source shows that code is still in place. How come?

I believe ever since WordPress 2.5, it automatically added the code to the header via the wp_head() hook.  So you may even have the “generator” code twice if you don’t remove this code from your theme.  Some more tips I found are here.

This suggestion is not helpful.  There are two main problems with with it: one, it assumes that there aren’t other ways to determine (or at least narrow) down which version of WordPress you are using.  Two, it assumes that folks attacking blogs actually care what version of WordPress you’re running.  The second one is the biggie, there are so many automated bots and attack scripts out there that will attempt various attacks, no matter what version of WordPress you are running. 

Since there is virtually no cost for them to try the attack anyway they don’t bother to find out what version of WordPress you are running.  Hence your suggesting removing something that is not usually checked for anyway.

From what I’ve seen, attackers don’t “search for WordPress 2.3.1″, they simply attack the blog.  Doesn’t matter what the version number is.  I see old attacks launched against blogs running the current version of WordPress all the time.

I do agree that the best thing to do is keep your install up to date.  I highly recommend checking it out from the Subversion repository, makes updates very easy.

Just adding  <?php remove_action(’wp_head’, ‘wp_generator’); ?> to your functions.php should do the trick.

I disagree. The problem with people hacking WP installs isn’t because of an obvious version number (which is more than often replicated in the footer of many free themes as well).

The problem is people never upgrading their WP installation. Quite frankly, this is the kind of useless tip that gives homage to the enemy. If we really want to make the world safe from hackers, we ought to send messages to those running old versions of WordPress harassing them into upgrading. And while that wouldn’t do any less to keep hackers at bay than removing the version meta data as suggested here, we at least would be occasionally accomplishing something, rather than giving people the false confidence that their outdated installation is now “secure” by deleting a line of code in header.php. A few extra minutes should be devoted to upgrading.

Having said that, the real problem is that although cPanel and other self-installing scripts push the latest version of WP pretty quickly, Automattic needs to find a way to cooperate with the major U.S. hosting services to force them to force their customers to upgrade. In other words, cPanel ought to also “lock” (flat-file) a WP-install once Automattic determines it is inherently unsafe to use anymore. Thus, their blog would still be up (as flat HTML files), but the Admin panel would be inaccessible and replaced with an admonition that an upgrade to version X.X is required to use WordPress.

It would be in Hosts best interest to do this. Although people will scream bloody murder (because they are lazy self-absorbed idiots who think the open-source world owes them a living), they will scream a lot louder once they get hacked, particularly if they lose data, and nagging at their host to fix all their problems. Better the first option than the second - plus the first option deters and deflates the egos of script-kiddies, a plus in my book. Also, the whining anti-upgrade crowd won’t be able to blog about it, at least not until they upgrade, so the noise level will be relatively diminished.

Do not remove your wp_head action!
Yes the latest versions of wordpress do add the version to the page via the wp_head call in numerous locations but this makes it easy to remove the version. Look in wp-includes/version.php and change the version number there and it will propogate throughout the system because all calls to bloginfo(’version’) read from this string in this file.

I change mine to:
/**
* The WordPress version string
*
* @global string $wp_version
*/
$wp_version = ‘(version removed for security)’;

Well, I’ve tried all the above methods for removing traces of my WordPress version from public viewing and none have worked.

I used a FireFox plugin for website info which leads to http://www.wmtips.com/tools/info/ and they still have my current WordPress version listed under “generator.”

I removed the generator/generated string from my theme header, removed WordPress from my footer, protected my version.php, tried

adding to functions.php

and

@global string $wp_version
*/
$wp_version = ‘(version removed for security)’;

Yet the above website still displays my current WordPress version.