by nsp-code 4.3 (274 reviews)

WP Hide & Security Enhancer

Name: WP Hide & Security Enhancer
Rating: 4.3 (274 reviews)
Author: nsp-code

Protect your website by concealing vulnerable WordPress traces, plugins, themes, login/admin url. 2FA, Captcha, Firewall, Security Headers etc.

WP Hide & Security Enhancer ranks #746 among WordPress.org plugins with 50,000+ active installations, is #101 of 4,529 in the Security category, a 4.3/5 rating from 274 reviews, and was last updated Aug 13, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v2.9.1 Current Version v2.9.1

Updated 1 month ago Last Update on 13 Aug, 2026

Refreshed 9 hours ago Last Refreshed on

#101 of 4,529 in Security Top 1% by installs Downloads -27.9% this week

View on WordPress.org

Rank

#746

+1 this week

Active Installs

50K+

-10.6%

KW Avg Position

43.8

0.2 worse

Downloads

3.4M

+149 today

Support Resolved

100%

— No change

Rating

86%

Review 4.3 out of 5

4.3 (274 reviews)

Next Milestone 60K

Total Progress 45.4%

50K+ 60K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 5,464 more installs to reach 60K+

Rank Changes

Current #746

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.3

274 reviews

Overall 86%

219 (80%)

7 (3%)

9 (3%)

5 (2%)

34 (12%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

100%

Resolution Rate

Security History

Source: WPVulnerability

5 known vulnerabilities on record · 1 in the last 24 months · checked 1 week ago

Dec 5, 2024

WP Hide & Security Enhancer [wp-hide-security-enhancer] < 2.5.2

CVE-2024-11585 · Fixed in v2.5.2
Aug 8, 2022

WP Hide & Security Enhancer [wp-hide-security-enhancer] < 1.8

CVE-2022-2538 · Fixed in v1.8
Jul 21, 2017

WP Hide & Security Enhancer [wp-hide-security-enhancer] < 1.4.1

Fixed in v1.4.1
Jul 21, 2017

WP Hide & Security Enhancer [wp-hide-security-enhancer] < 1.4

Fixed in v1.4
WP Hide & Security Enhancer [wp-hide-security-enhancer] < 1.4

Fixed in v1.4

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.9.1
Last Updated: Aug 13, 2026
Requires WP: 4.0+
Tested Up To: 7.1
PHP Version: 5.4 or higher
Author: nsp-code

Support & Rating

Rating: ★ ★ ★ ★ ☆ 4.3
Reviews: 274
Support Threads: 1
Resolved: 100%

Keywords

2FA headers hide login security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,751

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security - Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners who want to reduce the risk of automated hacking attempts. It hides WordPress core, theme, and plugin traces, and blocks default login and file paths so scanners cannot detect or exploit known vulnerabilities.

Customizes and blocks default Admin URL
Two-factor authentication (2FA)
Google Captcha V2/V3
Blocks XML-RPC API and creates new paths
Customizes plugin, theme, and upload URLs
Removes WordPress version and generator meta
Security HTTP response headers
Minifies HTML, CSS, JavaScript

Frequently Asked Questions

Common questions about WP Hide & Security Enhancer

Under the hood, this plugin never writes to, deletes, or modifies any existing files or directories on your server. Instead, it leverages WordPress’s built-in hook system and virtual URL rewrite rules—applied in memory—to seamlessly redirect and mask asset links. Rest assured, your core files, themes, and plugins remain exactly as you left them, with zero risk of unintended changes.

Yes—100% beginner-friendly. You don’t need to write a single line of PHP to customize or manage this plugin. Every feature is controlled via a clear, intuitive admin panel with descriptive labels, tooltips, and contextual help. Whether you want to hide common WordPress paths, rename your wp-content folder, or inject security headers, each option can be toggled on or off with a simple click. If you ever get stuck, hover over the question-mark icons for guidance, or check out our step-by-step documentation.

Yes, you can check out a live demo at https://demo.wp-hide.com/. Additionally, you can visit our official website, WP Hide and Security Enhancer, for more information.

Free Version: Does not auto generate native Nginx rewrite directives. However, you can still run it behind an Nginx reverse proxy or on hybrid setups (e.g., Apache + Nginx). However, it is fully compatible with Apache, LiteSpeed, IIS, and Nginx when used as a reverse proxy. For Nginx conside WP Hide PRO. WP Hide PRO: Includes a dedicated UI for generating Nginx configuration snippets—simply paste them into your server block to enable full URL masking, asset renaming, and security header rules. For more details, check out WP Hide PRO.

Yes, updates remain effortless. Our plugin is designed to play nicely with the WordPress update process. You can upgrade your core, themes, and all other plugins through the dashboard or via WP-CLI without disabling WP Hide. All rewrite rules and filters persist through updates, so there’s no downtime or extra steps required.

Not in the slightest. We only rewrite the paths to static assets (CSS, JS, images) and administrative URLs—your publicly visible content URLs (posts, pages, categories) remain unchanged. Search engines will continue to index your site normally, and any existing sitemaps or canonical tags will work exactly as before. In fact, by hiding version parameters and generic WordPress identifiers, you may see a slight improvement in perceived site quality.

Fully compatible. Whether you’re using WP Super Cache, W3 Total Cache, LiteSpeed Cache, or any other popular caching layer, WP Hide integrates without conflict. All rewritten URLs are cached just like your standard assets. If you enable HTML, CSS, or JS minification in your cache plugin, WP Hide will automatically adjust to serve the correct file paths.

Critical defenses, made easy. HTTP Security Headers (like Content Security Policy, X-Frame-Options, and Strict-Transport-Security) instruct browsers to apply extra safeguards when serving your site. Normally, you’d have to edit .htaccess or web server config files—now you can add, customize, and test these headers directly from a graphical interface. No manual coding, no syntax headaches; just point and click level security hardening.

Out of the box: • Apache (with .htaccess support) • IIS (web.config) • Any server behind Nginx, Varnish, or HAProxy For other environments: Consider upgrading to WP Hide PRO, which provides tailored configuration snippets and an enhanced Setup page for Nginx, OpenLiteSpeed, and more.

Enable .htaccess Processing Make sure your OpenLiteSpeed instance is configured to read .htaccess files—see this support thread for guidance. Adjust Cache Plugin Settings If you use LiteSpeed Cache, turn off the CSS/JS Minify option (under Optimization Settings) to prevent conflicts with WP Hide’s rewrite rules. Custom Config File If your server requires rules outside of .htaccess (e.g., in httpd-config.conf), WP Hide PRO can generate the exact rewrite blocks you need—no guesswork involved. See WP Hide PRO details.