UAU Ready
Description
With Hide My WP Ghost Pro, you protect WordPress by rewriting paths like wp-admin, wp-login, wp-content, and wp-json, applying a 7G/8G firewall and reducing visible signals to automated scanners. The plugin serves those who need to make fingerprinting harder, block suspicious access attempts, and control sensitive points of the site without altering the installation’s core files.
Key Features of Hide My WP Ghost Pro
- Path hiding
Rewrites standard login, admin, content, uploads, and REST API URLs. - 7G/8G Firewall
Applies server-side rules against malicious queries, XSS, and SQL injection. - XML-RPC blocking
Closes off a common vector for brute force and automated requests. - Text mapping
Replaces WordPress classes, paths, and traces in the rendered code. - Event logging
Monitors logins, changes, activations, and relevant actions within the dashboard.
Benefits of Hide My WP Ghost Pro
- Less public exposure
Makes it harder to automatically identify the technology used on the site. - Better protected login
Reduces recurring attacks against predictable authentication URLs. - Faster response
Makes it easier to track suspicious events before they become larger incidents. - Reversible configuration
Lets you adjust protections without modifying WordPress core files.
Who Is Hide My WP Ghost Pro For?
- Anyone maintaining WordPress sites exposed to bots, scanners, and frequent login attempts.
- You, if you need to hide WordPress’s technical footprint without touching the installation’s core.
- Agencies and developers who set up standardized protection across multiple client sites.
How to Download Hide My WP Ghost Pro
Hide My WP Ghost Pro is available for download here on Ultrapack. After downloading the .zip file, install it via Plugins > Add New > Upload Plugin, select the .zip, and activate it. After activation, configure the paths and security rules in the plugin’s dashboard.
Hide My WP Ghost Pro stands out for combining footprint hiding, URL hardening, and firewall filters into one practical layer for WordPress. For those who rely on a less predictable site for bots and scanners, the plugin helps reduce obvious attack points, track sensitive events, and keep the installation protected with settings controlled from the dashboard.
Frequently asked questions
Is Hide My WP Ghost Pro GPL-licensed?
Yes. Hide My WP Ghost Pro is distributed under the GPL (GNU General Public License). You may legally use, modify and redistribute it on as many sites as you want.
Can I use Hide My WP Ghost Pro on multiple sites?
Yes. You can install Hide My WP Ghost Pro on as many sites as you want. Only automatic updates through Ultrapack Auto Updater have a limit: from 3 to 80 sites, depending on the plan.
How much does Hide My WP Ghost Pro cost at Ultrapack?
Hide My WP Ghost Pro costs US$2.99 as a single purchase, and it is also included in the subscription plans starting at US$12/mo (VIP I).
Does Hide My WP Ghost Pro include updates?
Yes. The current version of Hide My WP Ghost Pro is 9.0.06, published at Ultrapack on Jun 30, 2026. Subscribers update straight from the WordPress dashboard with UAU (Ultrapack Auto Updater).
Is Hide My WP Ghost Pro scanned before publication?
Yes. Every version of Hide My WP Ghost Pro goes through a malware scan (ClamAV and YARA rules, at UltraHub) before it is published.
What changed in this version
Version 9.0.06
- Latest WP Ghost release with the full Hack Prevention suite, 8G Firewall, Brute Force protection, 2FA and Passkeys.
Version 7.0.03 02 June 2026
- Fix - WPML/Polylang with a custom or renamed REST API path: WPML Advanced Translation Editor and other REST API calls no longer fail with a network error in the admin
- Fix - REST API requests made through the ?rest_route= form are no longer mistakenly treated as normal page requests and blocked
- Fix - Renamed REST API path: legacy, cached and external clients still calling the default wp-json path are now recognized correctly instead of being 404'd
- Fix - Compatibility module for WPML: the Advanced Translation Editor sync routes and WPML/ICL admin-ajax requests are no longer rewritten with the active language prefix
- Fix - Some sites could show a blank page when source code optimization was enabled; the header/tag find & replace is now fail-safe and never blanks the output on a regex error
- Fix - Prefetch/speculation rules cleanup now removes the wp-admin and wp-*.php entries without leaving the rules JSON invalid
- Security - Hardened REST API detection: the firewall can no longer be bypassed by appending /wp-json/ (or ?rest_route=) to the query string of another request
- Security - Brute force protection also covers REST API Application Password authentication
- Security - Fixed unauthenticated Open Redirect via the `redirect_to` parameter on the custom logout URL.
Version 7.0.02 11 May 2026
- Fix - Compatibility with WPML and Polylang: static asset URLs (wp-content, wp-includes) no longer get the language prefix prepended (e.g. /en/wp-content/...) when "Change Relative URLs to Absolute URLs" is enabled
- Fix - Password-protected pages (built-in WordPress post password) now submit correctly on Nginx and other servers without server-level rewrites when the login URL is customized
- Fix - Refreshed knowledge base links across admin notices to point to the new documentation
- Fix - Minor bugs and typos
Version 7.0.01 15 April 2026
- Update - Added the option to roll back to the last stable version in the Backup/Restore page
- Fix - Corrected the colors in the dark mode style
- Fix - Rewrite rules not correctly displayed in the notification bar when rules must be added manually to the server config
- Fix - Typos and minor bugs
Version 7.0.00 31 March 2026
- Major Release: Security Score, Login Page Designer, Passkey 2FA, Security Threats Log, User Events Log, GEO Threats Map, and expanded 7G/8G Firewall rules. Free update for all users.
- New - Security Optimization Score (0-100) with dynamic gauge on the Overview dashboard and Security Check page
- New - Security Threats Log to track blocked attacks and malicious requests (limited view)
- New - User Events Log to track login activity and user changes (limited view)
- New - GEO Threats Map with top 5 threat countries on the Overview dashboard
- New - Country filter in Security Threats Log and User Events Log
- New - Login Page Designer with custom logo, background image, colors, and color scheme presets
- New - Contextual upgrade suggestions based on your site's actual threat data
- New - Two-Factor Authentication by Passkey (Face ID, Touch ID, Windows Hello)
- New - Each user can select their preferred 2FA method from their profile
- New - Trust current browser option for 2FA, skip verification on trusted devices
- New - Hide WordPress Common Paths with file extension filtering (html, txt, lock)
- New - Hide User Enumeration to block author discovery scans
- New - Dark mode support (browser-based)
- New - Translation in Indonesian (id_ID) language
- New - Translation in Turkish (tr_TR) language
- Firewall & Security Updates
- Update - Expanded 7G & 8G Firewall rules to block SQL injection, XSS, file inclusion, directory traversal, and automated vulnerability scans
- Update - Firewall rules optimized for reduced overhead under high attack traffic
- Update - Improved threat detection to stop malicious requests before WordPress core execution
- Update - Security Headers updated with latest best practices
- Compatibility
- Update - Compatibility with WordPress 7.0 and PHP 8.5
- Update - Compatibility with WooCommerce 10.6
- Update - Compatibility with Elementor, Bricks Builder, Blocksy, Nicepage, Avada, and Riode themes
- Update - Compatibility with WP Rocket, LiteSpeed, Nitropack, SiteGround Optimizer, and Cloudflare
- Update - Compatibility with Wordfence, Sucuri, and Solid Security
- Update - Compatibility with WP Engine, Kinsta, CloudPanel, Ploi.io, and IIS servers
- Update - Compatibility with WPML and Polylang for multilingual Brute Force, 2FA, and Magic Login texts
- Update - Translations updated in all 14 supported languages
- UI & Experience
- Update - Redesigned Overview dashboard with Security Optimization Score, threat chart, and GEO map
- Update - Improved Security Check page with numeric score and actionable task list
- Update - Reorganized Logs section into Security Threats and User Events
- Update - Translations updated in all 16 supported languages: Arabic, Brazilian Portuguese, Chinese (Simplified), Dutch, Finnish, French, German, Indonesian, Italian, Japanese, Portuguese, Romanian, Russian, Spanish, Turkish, and English (default).
- Fix - Dropdown and Help icon in the RTL languages
Release notes published by the developer.
How to install
Automatic updates: this item is updated by the Ultrapack Auto Updater. With it installed, the new version shows up in your dashboard like any other WordPress update (how to set it up).
- Download the file
hide-my-wp-ghost.zip. - In the WordPress dashboard, go to Plugins > Add New > Upload Plugin.
- Select the file
hide-my-wp-ghost.zipand click Install Now. - Click Activate.
- This item is already activated. If any screen asks for a license, enter any code; any email works in the email field.
Stuck on a step? Open a ticket telling us which one you stopped at.
