NexWP

Have your ever seen this line in the source code?

<meta name="generator" content="WordPress *.*.*" />

There are several reasons for WordPress to generate this line, but from the user’s point, it’s not a good idea to tell out what system and which version your site is.

To remove the “generator” line, please follow these two steps:

1. Find out what theme you are using, and in that theme folder, find a file named “functions.php”, if you don’t find this file, just create it.

2.Add this line to the end:

remove_action('wp_head', 'wp_generator');

It’s done! Very simple, right?

(continue reading…)

WordPress is open source, but that doesn’t mean it’s 100% safe, if some security vulnerabilities were discovered,  then disclosing that you are using that version almost means everybody could hack your site. So, it’s the best to hide the WordPress iden tag and the version number(especially).

1.Remove “readme.html” in the root folder.

readme.html is a common file with WP package, just to answer some basic questions, like how to install WordPress. You can visit “yourdomain/readme.html” to check that. This file contains the WordPress tag and version number, so you should rename this file or just remove it.

(continue reading…)

wp-content folder contains WordPress themes and plugins, or we just call them extensions, which makes your WordPress different from others. More or less, we all need to install some to enhance our WordPress system, just like we install softwares on our OS, but it also bring risks.

Do not install any untrust extension unless you know exactly what it’s doing.

We all heard about viruses and trojans, right? Although WP extensions are open source, people might not take the time to read the code line by line. On the other hand, writing secure code is a skill not every developer learns that well, it’s possible that an useful plugin become a backdoor for hackers. So, be careful to install something new.

Rename wp-content folder

I think WP should make this step a mandatory one at the beginning, and it’s also helpful for hiding that your system is WordPress.

Before renaming the wp-content folder, I should tell that some plugins and themes use “wp-content” directly in the code, which is not supposed.  In such cases, these extensions should be fixed at first( WP Widget Cache fix this in version 0.25.3), using WP_CONTENT_DIR or WP_CONTENT_URL insteadly.

Open the wp-config.php file in the root folder, and add these lines before this: require_once(ABSPATH . ‘wp-settings.php’), (normally the last line)


define('WP_CONTENT_FOLDERNAME', 'your-content');
define('WP_CONTENT_DIR', ABSPATH . WP_CONTENT_FOLDERNAME );
define('WP_CONTENT_URL', 'http://your-domain/'.WP_CONTENT_FOLDERNAME);
define('WP_PLUGIN_DIR', WP_CONTENT_DIR . '/plugins' );
define('WP_PLUGIN_URL', WP_CONTENT_URL.'/plugins');

Replace your-content with a new name you like, and replace your-domain with your site domain, then, you can rename “wp-content” folder to the new name.