How to completely hide wordpress version number [closed]

Question

Is there a way to completely hide WordPress version number? I tried a couple of tricks like: hiding version from meta-generator and from CSS by adding the following lines in functions.php of the current theme:

// remove wp version param from any enqueued scripts
function vc_remove_wp_ver_css_js( $src ) {
    if ( strpos( $src, 'ver=' ) )
        $src = remove_query_arg( 'ver', $src );
    return $src;
}
add_filter( 'style_loader_src', 'vc_remove_wp_ver_css_js', 9999 );
add_filter( 'script_loader_src', 'vc_remove_wp_ver_css_js', 9999 );

The problem is the wpscan still able to discover the version using the advanced fingerprinting:

WordPress version 4.5.3 identified from advanced fingerprinting

Is there any trick to hide the version even from wpscan?

Answer 1

I don't know all the methods used by WPScan but here is a function that I use to remove some data about the version. Perhaps in conjunction with your other methods it might be a solution.

// remove version info from head and feeds
function generator_version_removal() {
    return '';
}
add_filter('the_generator', 'generator_version_removal');

As was noted in the comments that most attackers won't bother checking, I think this is true. However, for those few who do check, I assume their attack is more sophisticated and you don't want to be caught among the fruit that hanging just low enough to grasp.

As was also noted in the comments, WPScan apparently checks multiple fingerprints and this covers just one. Hopefully, it might be the one you are missing. Perhaps it is just one of many.

My experience with WPScan is limited, but perhaps you can get a more verbose output.

Hope this helps a bit, it is only part of what you are looking for though.

ADDITION: Emoji Update. There was an Emoji update with version 4.2 (I believe 4.2) that was part of a big security update. I can't seem to find the post about it right now, but I remember something about a security hole that had been around for a while and was finally fixed via some clever use of Emoji. When the update came through and there was so much emphasis about Emoji people wondered why and so it was explained that it was something of a cover for the security update. Long story short: WP 4.2+ has an Emoji update that will let WPScan (and others) know that you are running at least that version.

ADDITION: (2016-07-15) Another plugin I have been using but its main purpose is for speed is called Remove Query Strings From Static Resources. I hadn't remembered this plugin at first but since the default query string appended to JS files is the WordPress version number when no other version is given. With that as the query string for multiple files it would be a dead giveaway to see what WP version you have.

Answer 2

In addition to the answer of @KnightHawk regarding the emoji, it is always good practice to disable this functionality in WordPress (both from security stand point and performance: yes, it loads tons of JavaScript and frankly it is even not so useful from usability stand point and user experience).

I use the code below in order to complete that.

<?php
/* --------------------------------------------------*/
/* Disable the emoji's
/* --------------------------------------------------*/
if(!function_exists('bm_disable_emojis')){
function bm_disable_emojis() {
    remove_action( 'wp_head', 'print_emoji_detection_script', 7 );
    remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
    remove_action( 'wp_print_styles', 'print_emoji_styles' );
    remove_action( 'admin_print_styles', 'print_emoji_styles' );    
    remove_filter( 'the_content_feed', 'wp_staticize_emoji' );
    remove_filter( 'comment_text_rss', 'wp_staticize_emoji' );  
    remove_filter( 'wp_mail', 'wp_staticize_emoji_for_email' );
    add_filter( 'tiny_mce_plugins', 'bm_disable_emojis_tinymce' );
}
}
add_action( 'init', 'bm_disable_emojis' );

And here is another piece of code, which can be used to disable TinyMCE editor's emoji:

<?php
/* --------------------------------------------------*/
/* Filter function used to remove the tinymce emoji plugin
/* --------------------------------------------------*/
if(!function_exists('bm_disable_emojis_tinymce')){
function bm_disable_emojis_tinymce( $plugins ) {
    if ( is_array( $plugins ) ) {
        return array_diff( $plugins, array( 'wpemoji' ) );
    } else {
        return array();
    }
}
}