WP Ghost (Hide My WP Ghost) – Security & Firewall

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 76% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ tguhany

   5mo ago

   A truly fantastic addition! And the technical support team is incredibly helpful. Every day we see new and improved updates that, with God’s grace, help the website achieve complete protection. Thank you, wpghost team!

   Read on wp.org ↗
2. ★★★★★ Ivison Ramos

   5mo ago

   O Hide My WP Ghost é fácil de usar e possui praticamente todos os recursos para proteger seu site WordPress. Continuem assim, vocês estão fazendo um ótimo trabalho! Hide My WP Ghost is easy to use with great, has almost ever feature to protect your WordPress website. Keep moving guys you are doing great.

   Read on wp.org ↗
3. ★★★★★ Adrian McMaster

   6mo ago

   WP Ghost is a really good plugin. I used Lite mode on most of my websites but now use a paid Pro Version of my main four websites that was getting attacked by rogue bots. The pro verson allows me to see a log and what the bots are with an IP Address. I noticed the rogues are using Cloudflare so it can be difficult to tell at first. Support is really good because I was help with a compatiblity problem with Windows Internet Information services and the URL Rewrite duplicating lines of code in the web.config file causing a 500 internal error. I do reccomend this plugin if you want to protect your websites against rogue bots.

   Read on wp.org ↗
4. ★★★★★ sebastian

   8mo ago

   Once you set up a WordPress site, you’ll begin attracting visitors, not to buy, but to your login page and access like  XML-RPC from automated servers worldwide, all aiming to access your WordPress dashboard. You may not even notice if they succeed, but your paid campaigns could inadvertently redirect your clients elsewhere. This tool helps ghost your WordPress site, changing you loging page, even making it more challenging for competitors to discover and replicate your strategies, or make it more professional like changing wp-content path to content o anything you like like files, so make your site looks is custom made. The support team is excellent; I recently raised an issue regarding compatibility between aaPanel, multi-server Nginx + LiteSpeed, and they promptly provided a solution along with compatibility details. Their support is excellent, you fell like talking to people no those support that just blame others.

   Read on wp.org ↗
5. ★★★★★ uknew

   8mo ago

   I’ve been using WP Ghost for over three years. I’ve used other paid plugins, but they’ve caused various issues, including speed issues, on my site. However, WP Ghost, along with the caching and SEO plugins, has always worked flawlessly. The customer service is also excellent.

   Read on wp.org ↗
6. ★★★★★ uxdesign

   11mo ago

   I was having a good ol’time with WP Ghost Lite until I migrated hosts. New host said “There’s an incompatibility with the hide-my-wp plugin because the core files are symlinked, which resulted in the issue” (404 for all CSS).

   Read on wp.org ↗
7. ★★★★★ beartsi

   11mo ago

   Great plugin and easy to use. Works flawlessly. No complaints so far.

   Read on wp.org ↗
8. ★★★★★ norzer

   1.2y ago

   I’ve been using the product for about a year now. It’s really growing. We are going to start using it on all client sites. Great work. Thanks

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 7.0.07 Security – Two-Factor Authentication settings are now bound to the account they belong to, so the 2FA method, authenticator, email codes, backup codes and passkeys can only be managed by the account owner or by an admini 7.0.07
2. — Version 7.0.06 Fix – Editing a custom post type that uses the built-in Categories/Tags taxonomy no longer crashes the Block Editor Fix – Block Editor no longer crashes with “Cannot read properties of undefined” when Hide User Enumerati 7.0.06
3. — Version 7.0.05 New – Force 2FA Setup: require selected user roles to set up Two-Factor Authentication before they can access the dashboard, with a guided setup screen shown right after login Fix – Temporary Login page no longer trigger 7.0.05
4. — Version 7.0.04 New – Frontend Check now also verifies the theme’s CSS and JS files load, catching a broken layout on pages that still return 200 New – Detects when CSS/JS/font files load through WordPress instead of the server config, 7.0.04
5. — Version 7.0.03 Fix – WPML/Polylang with a custom or renamed REST API path: WPML Advanced Translation Editor and other REST API calls no longer fail with a network error in the admin Fix – REST API requests made through the ?rest_route= 7.0.03
6. — Version 7.0.02 Fix – Compatibility with WPML and Polylang: static asset URLs (wp-content, wp-includes) no longer get the language prefix prepended (e.g. /en/wp-content/…) when “Change Relative URLs to Absolute URLs” is enabled Fix – Pa 7.0.02

10 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 WP Ghost (Hide My WP Ghost) – Security & Firewall < 7.0.05 - IP Spoofing to Protection Mechanism Bypass ↗
   2026-08-04 CVE-2026-11870 Use of Less Trusted Source Affects < 7.0.05 Patched in 7.0.05
2. Medium · 4.3 WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass ↗
   2026-07-23 CVE-2026-59546 Improper Authentication Affects <= 7.0.06 Patched in 7.0.07
3. Medium · 4.7 Hide My WP Ghost < 7.0.00 - Unauthenticated Open Redirect ↗
   2026-03-18 CVE-2026-39484 URL Redirection to Untrusted Site ('Open Redirect') Affects < 7.0.00 Patched in 7.0.00
4. Critical · 9.8 Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion ↗
   2025-03-19 CVE-2025-26909 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 5.4.01 Patched in 5.4.02
5. High · 7.5 WP Ghost <= 5.4.01 - Unauthenticated Limited File Read ↗
   2025-03-13 CVE-2025-2056 Relative Path Traversal Affects <= 5.4.01 Patched in 5.4.02
6. Medium · 5.3 Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure ↗
   2025-02-11 CVE-2024-13794 Protection Mechanism Failure Affects <= 5.3.02 Patched in 5.4.01
7. Medium · 6.1 Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL ↗
   2024-11-14 CVE-2024-10825 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.3.01 Patched in 5.3.02
8. Medium · 5.3 Hide My WP Ghost – Security & Firewall <= 5.2.01 - Login Page Disclosure ↗
   2024-07-02 CVE-2024-6420 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.2.01 Patched in 5.2.02
9. Medium · 5.3 Hide My WP Ghost <= 5.0.25 - CAPTCHA Bypass in brute_math_authenticate ↗
   2023-08-22 CVE-2023-34001 Reliance on Untrusted Inputs in a Security Decision Affects <= 5.0.25 Patched in 5.0.26
10. Medium · 6.5 Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass ↗
    2023-05-08 CVE-2022-4537 Use of Less Trusted Source Affects <= 5.0.18 Patched in 5.0.20

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 15 languages, 3 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-31 90K+ → 100K+ up after 1 days in tier
2. 2026-07-30 80K+ → 90K+ up after 3 days in tier
3. 2026-07-27 70K+ → 80K+ up after 1 days in tier
4. 2026-07-26 80K+ → 70K+ down after 1 days in tier
5. 2026-07-25 70K+ → 80K+ up after 1 days in tier
6. 2026-07-24 80K+ → 70K+ down after 1 days in tier
7. 2026-07-23 90K+ → 80K+ down after 1 days in tier
8. 2026-07-22 100K+ → 90K+ down after 410 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• IP Geo Block 8K+ installs · 4.1★ · 4 shared tags D
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 3 shared tags A
• Security Optimizer – The All-In-One Protection Plugin 1M+ installs · 4.5★ · 3 shared tags A
• Anti-Malware Security and Brute-Force Firewall 100K+ installs · 4.9★ · 3 shared tags A
• WP fail2ban – Advanced Security 60K+ installs · 4.1★ · 3 shared tags C
• Security Plugin, Firewall & Malware Scanner with Auto Removal 40K+ installs · 4.7★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for WP Ghost (Hide My WP Ghost) – Security & Firewall into a readme, a review or a deck. It updates itself.

WP Ghost (Hide My WP Ghost) – Security & Firewall: 100K+ active installs, 4.5★ (372 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/hide-my-wp