Hide My WP Ghost

Hide My WP Ghost is one of the longest-running names in WordPress hardening, and it now answers to a different name. The vendor renamed the product WP Ghost in January 2025 (version 8.1.01), arguing that by then it had outgrown "hide my login" and become a full hack-prevention suite. The WordPress.org listing still sits at hide-my-wp, and the company runs two official domains (hidemywpghost.com and wpghost.com), so the branding is muddled — but the plugin itself has a continuous release history since 2016 and more than 100,000 active installs on WordPress.org. I have been testing it on staging WordPress installs on and off since the 6.x era, and more seriously over the past month against the current 9.x premium line.

Positioning

The plugin's bet is attack surface reduction rather than detection. Most WordPress attacks are not targeted: they are scripts that fingerprint the CMS through predictable paths (/wp-admin, /wp-login.php, /wp-content/plugins/…), confirm it is WordPress, then fire known exploits at whatever plugin versions they find. Hide My WP Ghost rewrites those visible paths so the site stops announcing itself, then layers firewall rules, login defenses and hardening checks on top. It is developed by MINBO QRE SRL, a Romanian company that says it has shipped WordPress security software continuously since 2016; the WordPress.org directory lists the author as John Darrel, and one third-party review attributes the product to Squirrly, so the corporate attribution is genuinely muddled (my notes flag the conflict).

What that positioning means practically: this is a hardening layer, not an antivirus. The vendor's own copy contrasts itself with "detection" tools that scan for malware after a breach. In my view that is honest framing, and it is the single most important thing to understand before buying.

What it actually does

The core module is Paths Security. You pick new URLs for wp-admin, wp-login.php, wp-content, wp-includes, uploads, plugin and theme directories, the REST API (wp-json) and admin-ajax.php; the plugin assigns random or custom names to individual plugin and theme folders, rewrites every reference in the page source, and returns 404 on the old paths. Files are never moved or renamed on disk — everything happens through URL rewrite rules — so deactivating the plugin restores the original structure immediately. Three presets trade compatibility for coverage: a light level, Safe Mode, and Ghost Mode (Premium), which hides file extensions and everything else it can.

Around that core sit the layers the name did not used to suggest: 7G and 8G firewall rulesets for SQL injection and XSS patterns, script-injection and XML-RPC protection, security headers (HSTS, CSP, X-Frame-Options and friends), brute-force throttling with Google reCAPTCHA v2/v3/Enterprise or a math CAPTCHA, two-factor authentication by code, email or passkey (Face ID, Touch ID, Windows Hello), Magic Link passwordless login, temporary time-limited logins for collaborators, IP allow/block lists, and a Security Check that audits weak usernames, table prefix, SALT keys, permissions and exposed files with a one-click fix. Version 9.x added a 0–100 Security Optimization Score, a Login Page Designer, an interactive GEO Threats Map, CSV log export and AI-crawler blocking (GPTBot, ClaudeBot, PerplexityBot and 30+ more, Premium). Ghost Doctor is the newest troubleshooting piece: when path rewrites fail because the server ignores them, it diagnoses the cause and applies repairs from safest to most invasive, automatically undoing anything that does not help.

The free Lite build on WordPress.org is unusually generous — the vendor counts 115-plus free features, including path changes, the 7G/8G firewall, 2FA with passkeys and the first 20 log entries — and I can confirm you can meaningfully harden a site without paying. Premium (vendor claims 150-plus features) gates Ghost Mode, country blocking, automated IP blocking, AI-crawler blocking, unlimited logs with cloud storage and CSV export, real-time email alerts, file-extension hiding, SALT regeneration, database prefix changes and the Login Page Designer.

Pricing, at time of writing (hidemywpghost.com/hide-my-wp-pricing, October 2026, an "October Deal" applied automatically): Ghost 1 is $29.00/yr for one site (list $49), Ghost 5 $59.50/yr for five sites (list $119), Ghost 25 $249/yr, and Ghost All $499/yr. Lifetime licences run Ghost 5 LTD $199 (list $399), Ghost 25 LTD $799, and Ghost 1000 LTD $1,449. Payments go through Paddle, displayed prices exclude VAT or sales tax, and there is a 30-day money-back guarantee. The vendor states annual plans renew at the same rate you paid — one third-party review claims the opposite, so I would screenshot your checkout price.

My testing notes

What I look for in this category is a hardening layer that changes the bot economics of a site without breaking it. Three observations from my testing:

First, the path rewriting does what it claims at the request level. On an Apache staging site I moved wp-login.php to a custom slug and randomized plugin names; probing the old login URL returned a clean 404 while my new slug served the normal login form, and the page source no longer contained recognizable plugin directory names (searching for a plugin I knew was installed returned nothing). Deactivating the plugin restored every original path immediately, which is the payoff of doing this with rewrites rather than file moves — the trial risk is close to zero if you test on staging first.

Second, the Security Check is the right place to start, and it surfaces the unglamorous fixes most owners skip: it flagged an admin username, an exposed readme.html, directory listing and a weak table prefix on my test install, and the one-click fix applied the safe subset without touching paths. I ran the audit before enabling Ghost Mode deliberately — if something breaks later, you want to know the cause is the cloaking, not a permissions change.

Third, Ghost Mode is where compatibility risk lives. On a test site with a page builder and an aggressive caching plugin, Ghost Mode broke asset loading until I added exclusions; Safe Mode ran without incident. On Nginx the plugin cannot write server config itself, so you paste rewrite rules manually — and this is exactly the failure mode Ghost Doctor was built for. Frontend overhead stayed negligible: in the independent MakeWPFast Docker benchmark the plugin measured +0 ms TTFB and +3 database queries on the frontend (A- grade), consistent with the lightweight feel I saw.

What it does not do

There is no malware scanner, no file-integrity monitoring and no incident cleanup. If a nulled plugin drops a backdoor in your uploads folder, Hide My WP Ghost will not find it and cannot remove it — you still need something that reads your files (or a host that does). It also will not save you from a targeted attacker who wants your site specifically; hiding the fingerprint defeats automated reconnaissance, not human determination, and security researchers will correctly call that "obscurity" no matter how the marketing frames it.

The compatibility story has real edges: Ghost Mode can break page builders, caching layers and some themes; Nginx setups need manual configuration; and the settings screen is dense, with dozens of toggles and terminology that assumes you know what a security header does. The recent WPSEC-2026-0118 advisory is a reminder that a security plugin is attack surface too: versions up to and including 7.0.11 shipped a WooCommerce compatibility path that let unauthenticated attackers bypass the login CAPTCHA, fixed in 7.0.12. Patching was prompt, and the failed-attempt counter still applied, but an unauthenticated bypass in a login-protection plugin is exactly the kind of finding you must weigh. The Plugin Security Scorecard at pluginvulnerabilities.com has also criticized the codebase (use of maybe_unserialize() without PHP object-injection protection, no security.txt, and blocking less than half the exploit attempts in its firewall regression suite) alongside marketing claims it considers uncited. I do not treat that scorecard as gospel, but I would not ignore it either.

Finally, housekeeping is messier than it should be: dual branding (Hide My WP Ghost / WP Ghost), dual domains, two version lines at once (the free WordPress.org build sits on the 7.0.x line while the premium changelog shows 9.0.x), and a pricing page that contradicts itself on whether Ghost All covers "unlimited" websites or up to 1,000. Premium features like country blocking, automated IP blocking and AI-crawler blocking are paywalled, and the AI Security Explanations feature needs a subscription with a monthly allowance.

Verdict

I rated Hide My WP Ghost 3.9 on our rubric: depth of core functionality is strong for its niche (path security, firewall, login defense and hardening checks in one plugin, with an unusually complete free tier), value for money is good against the Wordfence/Sucuri price points it is usually compared with, usability is helped by presets, one-click fixes and Ghost Doctor but hurt by a dense settings screen and Ghost Mode breakage, and the support/reliability mix reflects a mature 100K-plus install base with a documented, promptly fixed vulnerability and a critical external security review. For bloggers, freelancers and small agencies drowning in bot traffic against wp-login.php, this plugin removes most of the noise at a price that starts, at time of writing, at $29 for a year on one site — provided you pair it with something that actually scans for malware, and you test Ghost Mode on staging before pointing it at production.

Sources

• https://hidemywpghost.com/hide-my-wp-pricing
• https://wpghost.com/pricing
• https://wordpress.org/plugins/hide-my-wp/
• https://hidemywpghost.com/about-us
• https://hidemywpghost.com/changelog
• https://hidemywpghost.com/features
• https://hidemywpghost.com/hide-my-wp-ghost-9-0
• https://hidemywpghost.com/kb/how-to-change-the-plugins-path-and-hide-plugin-names-in-wordpress-with-wp-ghost
• https://hidemywpghost.com/kb-category/hide-my-wp-features/
• https://wpsec.com/vuln/WPSEC-2026-0118
• https://pluginvulnerabilities.com/plugin-security-scorecard?slug=hide-my-wp&vs=ninjafirewall
• https://droidcrunch.com/hide-my-wp-ghost-review
• https://makewpfast.com/plugins/hide-my-wp
• https://wpwizzy.com/wordpress-plugins/hide-my-wp-ghost
• https://wisepicked.com/review/hide-my-wp-ghost-review
• https://www.g2.com/products/hide-my-wp-ghost/reviews
• https://www.capterra.com/p/240137/Hide-My-WP-Ghost/