0

Is there a way to completely hide WordPress version number? I tried a couple of tricks like: hiding version from meta-generator and from CSS by adding the following lines in functions.php of the current theme:

// remove wp version param from any enqueued scripts
function vc_remove_wp_ver_css_js( $src ) {
    if ( strpos( $src, 'ver=' ) )
        $src = remove_query_arg( 'ver', $src );
    return $src;
}
add_filter( 'style_loader_src', 'vc_remove_wp_ver_css_js', 9999 );
add_filter( 'script_loader_src', 'vc_remove_wp_ver_css_js', 9999 );

The problem is the wpscan still able to discover the version using the advanced fingerprinting:

WordPress version 4.5.3 identified from advanced fingerprinting

Is there any trick to hide the version even from wpscan?

closed as off-topic by Gilles, techraf, LvB, Steffen Ullrich, Matthew Jul 28 '16 at 8:51

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Gilles, techraf, LvB, Steffen Ullrich, Matthew
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    you would need to figure out how wpscan fingerprints and tweak what your install returns in those scans - I'm not sure that's worth any effort, though - why do you want to hide the version number? Are you using an old version that you cannot upgrade? – schroeder Jul 11 '16 at 9:46
  • Welcome on Security SE. While this question is indeed motivated by security-related purpose, it is mainly a question about how to use WordPress than a general security question. You should therefore check this on WordPress Development community. Moreover, CSS only visually hides a content, software has still access to it, and the first result in my search engine returns this page. – WhiteWinterWolf Jul 11 '16 at 9:48
  • thank you "schroeder" for your replay. My WordPress installation is up to date but i want to hide the version to provide extra layer of security to my site in case I forget to update my WordPress installation. – Ahmed M. Taher Jul 11 '16 at 9:58
  • Thank you "WhiteWinterWolf" . I will take a look at the plugin you suggest. I am new to this site, and if I have any question regarding wordpress in the future I will ask in the proper section. – Ahmed M. Taher Jul 11 '16 at 10:02
  • 3
    Hiding the version does not provide an extra layer of security. Most attackers won't query the version (that's unreliable, the software might have been patched without updating the version number), they'll just launch exploits and see if they succeed. – Gilles Jul 11 '16 at 12:27
1

I don't know all the methods used by WPScan but here is a function that I use to remove some data about the version. Perhaps in conjunction with your other methods it might be a solution.

// remove version info from head and feeds
function generator_version_removal() {
    return '';
}
add_filter('the_generator', 'generator_version_removal');

As was noted in the comments that most attackers won't bother checking, I think this is true. However, for those few who do check, I assume their attack is more sophisticated and you don't want to be caught among the fruit that hanging just low enough to grasp.

As was also noted in the comments, WPScan apparently checks multiple fingerprints and this covers just one. Hopefully, it might be the one you are missing. Perhaps it is just one of many.

My experience with WPScan is limited, but perhaps you can get a more verbose output.

Hope this helps a bit, it is only part of what you are looking for though.

ADDITION: Emoji Update. There was an Emoji update with version 4.2 (I believe 4.2) that was part of a big security update. I can't seem to find the post about it right now, but I remember something about a security hole that had been around for a while and was finally fixed via some clever use of Emoji. When the update came through and there was so much emphasis about Emoji people wondered why and so it was explained that it was something of a cover for the security update. Long story short: WP 4.2+ has an Emoji update that will let WPScan (and others) know that you are running at least that version.

ADDITION: (2016-07-15) Another plugin I have been using but its main purpose is for speed is called Remove Query Strings From Static Resources. I hadn't remembered this plugin at first but since the default query string appended to JS files is the WordPress version number when no other version is given. With that as the query string for multiple files it would be a dead giveaway to see what WP version you have.

0

In addition to the answer of @KnightHawk regarding the emoji, it is always good practice to disable this functionality in WordPress (both from security stand point and performance: yes, it loads tons of JavaScript and frankly it is even not so useful from usability stand point and user experience).

I use the code below in order to complete that.

<?php
/* --------------------------------------------------*/
/* Disable the emoji's
/* --------------------------------------------------*/
if(!function_exists('bm_disable_emojis')){
function bm_disable_emojis() {
    remove_action( 'wp_head', 'print_emoji_detection_script', 7 );
    remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
    remove_action( 'wp_print_styles', 'print_emoji_styles' );
    remove_action( 'admin_print_styles', 'print_emoji_styles' );    
    remove_filter( 'the_content_feed', 'wp_staticize_emoji' );
    remove_filter( 'comment_text_rss', 'wp_staticize_emoji' );  
    remove_filter( 'wp_mail', 'wp_staticize_emoji_for_email' );
    add_filter( 'tiny_mce_plugins', 'bm_disable_emojis_tinymce' );
}
}
add_action( 'init', 'bm_disable_emojis' );

And here is another piece of code, which can be used to disable TinyMCE editor's emoji:

<?php
/* --------------------------------------------------*/
/* Filter function used to remove the tinymce emoji plugin
/* --------------------------------------------------*/
if(!function_exists('bm_disable_emojis_tinymce')){
function bm_disable_emojis_tinymce( $plugins ) {
    if ( is_array( $plugins ) ) {
        return array_diff( $plugins, array( 'wpemoji' ) );
    } else {
        return array();
    }
}
} 

Not the answer you're looking for? Browse other questions tagged or ask your own question.