by John Darrel 4.5 (373 reviews)

Hide My WP Ghost – Security & Firewall

Name: Hide My WP Ghost – Security & Firewall
Rating: 4.5 (373 reviews)
Author: John Darrel

Hide My WP Ghost is a WordPress security plugin that hides WP paths and protects your site with Path Security, Firewall, Brute Force Protection, 2FA

Hide My WP Ghost ranks #401 among WordPress.org plugins with 100,000+ active installations, is #18 of 1,659 in the Authentication category, a 4.5/5 rating from 373 reviews, and was last updated Oct 30, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v7.0.16 Current Version v7.0.16

Updated 2 days ago Last Update on 30 Oct, 2026

Refreshed 18 hours ago Last Refreshed on

#18 of 1,659 in Authentication Top 1% by installs Downloads +64.2% this week Actively maintained

View on WordPress.org

Rank

#401

— No change

Active Installs

100K+

-16.7%

KW Avg Position

— No change

Downloads

2.9M

+324 today

Support Resolved

60%

— No change

Rating

90%

Review 4.5 out of 5

4.5 (373 reviews)

Next Milestone 200K

Total Progress 34.3%

100K+ 200K+

119

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 65,746 more installs to reach 200K+

Rank Changes

Current #401

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.5

373 reviews

Overall 90%

317 (85%)

5 (1%)

8 (2%)

9 (2%)

34 (9%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

60%

Resolution Rate

Security History

Source: WPVulnerability

18 known vulnerabilities on record · 13 in the last 24 months · checked 1 week ago

Sep 18, 2026

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 7.0.13

CVE-2026-89051 · Fixed in v7.0.13
Sep 18, 2026

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 7.0.11

CVE-2026-86796 · Fixed in v7.0.11
Sep 18, 2026

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 7.0.11

CVE-2026-86800 · Fixed in v7.0.11
Sep 7, 2026

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 7.0.03

CVE-2026-7527 · Fixed in v7.0.03
Aug 4, 2026

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 7.0.10

CVE-2026-81806 · Fixed in v7.0.10
Jul 30, 2026

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 7.0.05

CVE-2026-11870 · Fixed in v7.0.05
Jul 23, 2026

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 7.0.07

CVE-2026-59546 · Fixed in v7.0.07
Mar 18, 2026

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 7.0.00

CVE-2026-39484 · Fixed in v7.0.00
Jan 13, 2026 UNPATCHED

Hide My WP Ghost – Security & Firewall [hide-my-wp] <= 6.2.12 (unfixed)

CVE-2025-69098 · No fix released
Mar 19, 2025

Hide My WP Ghost – Security & Firewall [hide-my-wp] < 5.4.02

CVE-2025-26909 · Fixed in v5.4.02

Showing the 10 most recent of 18 records.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 7.0.16
Last Updated: Oct 30, 2026
Requires WP: 5.8+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: John Darrel

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.5
Reviews: 373
Support Threads: 5
Resolved: 60%

Keywords

Brute Force firewall hide my wp login security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners and agencies who want to harden their site against automated attacks. It hides and secures common WordPress paths, adds firewall, brute-force, and authentication protections to reduce the attack surface bots use to identify and target the site.

Change wp-admin & wp-login.php URLs
8G & 7G Firewall filters
Passkey authentication (Passwordless 2FA)
Standard 2FA (code & email)
Security headers (CSP, HSTS, X-Frame-Options)
Disable XML-RPC and REST API access
Integrated ReCaptcha for brute force protection
Temporary logins for developers/clients

Frequently Asked Questions

Common questions about Hide My WP Ghost – Security & Firewall

WP Ghost provides request filtering, login protection and path controls, with Security Check tasks for WordPress hardening.

The free plugin includes the 2026 Ghost Firewall, Brute Force protection, 2FA and Security Check; Premium adds features such as automated IP blocking and cloud event retention.

WP Ghost lets you set login attempt limits and lockouts, add CAPTCHA, and require 2FA for selected user roles.

WP Ghost rewrites public URLs while leaving WordPress files in their existing directories.

A custom login URL reduces exposure at the default address, but WordPress still needs updates, strong authentication and backups.

WP Ghost focuses on prevention and configuration checks; use a malware scanner and a cleanup process for an existing infection.

Check which protections your host provides, then use WP Ghost for missing controls such as custom login paths or role-based 2FA.

WP Ghost can limit repeated checkout submissions and failed payment attempts from the same IP address; distributed attacks may need controls from your payment provider or host.

From version 7.0.15, WP Ghost includes checks for injection patterns, AJAX and REST requests, and malicious uploads, with comment and form checks on levels 3 and 4.

Ghost Doctor tests the homepage and asset URLs as a logged-out visitor, applies supported repairs, and reverts changes that fail its follow-up check.