Hide My WP Ghost: WordPress Security Plugin Review

Your login page sits at /wp-admin. Every bot on the internet knows that, and a fresh WordPress install starts getting probed within hours of going live.

Hide My WP Ghost (now sold simply as WP Ghost) moves that door, hides your theme and plugin paths, and puts a firewall in front of the rest. So does hiding paths actually stop anything? Partly. Here is where this WordPress security plugin earns its licence fee, where it breaks things, and how it stacks up against the other WordPress security plugins we rate.

Quick verdict

Our take: WP Ghost does one job better than any general-purpose security plugin. It stops your site looking like WordPress. That alone kills most of the automated traffic hammering wp-login.php and sniffing around /wp-content/plugins/ for a known hole. What it won’t do is scan for malware or clean an infected site, so treat it as a hardening layer rather than your whole defence.

Best for: bloggers, freelancers and small agencies who want to cut bot noise and login attacks without paying for a managed firewall every month.

Not ideal for: anyone who needs malware scanning, file-integrity checks and incident cleanup from one product. Wordfence or Sucuri fit that job better.

Full score, pros and cons are in the review box below.

Hiding paths is not magic, but bots fall for it

Security people will tell you obscurity isn’t security, and they’re right. Renaming wp-login.php won’t stop somebody who has decided to break into your site specifically.

Here’s the catch: almost nobody is attacking you specifically. The overwhelming majority of hits on a small WordPress site come from scripts that fingerprint the CMS, look for a known vulnerable plugin version, and move on if the fingerprint doesn’t match. Break the fingerprint and most of that traffic never reaches your PHP. That’s a real saving in server load as well as risk, which is why we’d rather run this alongside a decent host than instead of one. Our Hostinger review covers the hosting side of that equation.

What you actually get

Changing and hiding the common paths

This is the headline feature. You pick new URLs for wp-admin, wp-login.php, wp-content, wp-includes, plugin folders and theme folders, and the plugin rewrites them everywhere they appear, including inside your page source. Three presets do the heavy lifting: Default, Safe Mode (compatible with everything, lighter cloaking) and Ghost Mode (aggressive, and the one most likely to need tuning).

Brute force and login protection

You get login attempt limits, IP blacklisting and whitelisting, country blocking on paid plans, a hidden login URL and email alerts when somebody tries. Two-factor authentication is in there too, which is worth flagging because older reviews of this plugin (ours included) said it wasn’t.

Firewall rules, XML-RPC and injection filters

The plugin adds request filters for SQL injection and cross-site scripting patterns, sets security headers, and lets you disable or restrict xmlrpc.php. If you don’t use the WordPress mobile app or Jetpack, killing XML-RPC outright removes a whole category of brute force amplification. That single toggle is worth the install on its own.

Security check and event log

A one-click audit runs through a long list of hardening checks (file permissions, exposed readme files, directory listing, database prefix, admin username) and tells you what to fix. The paid tiers add unlimited event logging with cloud storage and real-time email notifications. The free build keeps a shorter log.

Real-world tip: run the audit before you switch on Ghost Mode. Fixing the boring stuff first means that if something breaks later, you know it was the cloaking and not a permissions change.

Our value judgment: at the discounted price WP Ghost usually sells at, a single-site licence costs less than a takeaway and does more for your risk profile than most $99 plugins. At full list price against a $149 Wordfence Premium licence, it’s a harder sell, because Wordfence gives you scanning too. Buy it on discount, or run the free build and spend the money on backups.

Where it falls short

No malware scanner. This is the big one. If a compromised plugin drops a backdoor in your uploads folder, WP Ghost will not find it and cannot clean it. You still need something that reads your files.

Ghost Mode breaks things. Page builders that hardcode asset paths, aggressive caching layers, some CDNs and a handful of themes will misbehave when every URL is rewritten. Safe Mode is the sane default and the docs are honest about that.

The settings screen is dense. Dozens of toggles, no guided onboarding, and terminology that assumes you already know what a security header does. Beginners will switch things on without understanding them.

And obscurity has a ceiling. Determined attackers fingerprint WordPress in a dozen other ways, from REST API responses to feed URLs. WP Ghost plugs many of them, not all.

Running WP Ghost next to Wordfence works fine in practice, and that pairing is what we’d actually recommend: obscurity from one, scanning from the other. If your budget only stretches to one paid licence, buy the scanner. If you want a second opinion on the scanning side, our iThemes Security Pro review covers that route.

Frequently Asked Questions

The bottom line

Hide My WP Ghost is worth installing, and for a lot of small sites the free build is all you need. Hiding your WordPress login URL and plugin paths removes an enormous amount of automated attack traffic, and the security audit catches the hardening jobs most people never get round to.

Buy the paid licence if you want country blocking, real alerts and full logs, and buy it on one of the frequent discounts rather than at list price. Pair it with a scanner: WP Ghost hides you, it does not heal you. And whichever route you take, start in Safe Mode with a tested backup, because a locked-out admin at 2am is a worse problem than the bots you were trying to block.

Prices checked July 2026 against the official pricing page. Some links here are affiliate links, which means we may earn a commission at no extra cost to you. It does not change our score.