There’s….. a…… BOT….. COMING… FOR… YOUR… SITE!!!!!!!!! And maybe it wants to peep your meta tags or RSS feed to see what version of WordPress you’re using and see if it can exploit that. But you say, “NOPE!” Because you’re using this script which will remove your version number from the HTML source and RSS feed. BAM! (Note: yea… it’s not foolproof, because your version number is still sometimes exposed in script and style urls in your HTML source – but we’re not tackling those now.)
See the code…
<?php
if ( ! class_exists( 'WordPress_Security_RemoveVersion', false ) ) {
class WordPress_Security_RemoveVersion {
const VERSION = '1.2';
public function __construct() {
add_action( 'after_setup_theme', array( $this, 'remove_version_numbers' ), 999 );
add_action( 'rss2_head', array( $this, 'remove_rss_version_number' ) );
}
/**
* Remove the version numbers from the generator tags.
*/
public function remove_version_numbers() {
// Remove the wp_generator action from the wp_head hook.
remove_action( 'wp_head', 'wp_generator' );
// Add a filter to the the_generator hook to remove the version number.
add_filter( 'the_generator', array( $this, 'remove_version_number' ) );
}
/**
* Remove the version number from the generator tag.
*
* @param string $html The original HTML string.
* @return string The modified HTML string with the version number removed.
*/
public function remove_version_number( $html ) {
// For this we just return empty string to remove the HTML entirely.
return '';
}
/**
* Remove the version number from the RSS feed generator tag.
*/
public function remove_rss_version_number() {
remove_action( 'wp_head', 'wp_generator' );
remove_action( 'rss2_head', 'the_generator' );
}
}
// Instantiate the class.
new WordPress_Security_RemoveVersion();
}
Leave a Reply