"WordPress version exposed" means your site's code announces which WordPress version it runs, usually in a generator tag. It's a possible exposure, not a vulnerability. If the version is old, it tells automated tools what to try. Fix it by updating WordPress, your theme and plugins first, then removing the generator tag with a security plugin or a one-line snippet.
If your CyberVigil report says your WordPress version is exposed, your site is announcing which version of WordPress it runs. That's a possible exposure, not a vulnerability, and it doesn't mean anyone has broken in. The real fix is keeping WordPress up to date. Hiding the number is a small extra step that takes a few minutes.
Run a scan below to see exactly which version details your site shows.
- Free check
- No signup
- No changes to your website
What does "WordPress version exposed" mean?
By default, WordPress adds a line like this to the code of every page:
<meta name="generator" content="WordPress 6.2.1" />
This is called the generator tag. Visitors never see it, but anyone can find it by viewing your page source and searching for "generator."
Our scan reads your homepage's code and response headers. It flags the generator tag when it contains a version number, and it also flags server headers that do the same, such as Server: Apache/2.4.41 or X-Powered-By: PHP/8.1. In your report, this shows up under "Software versions," with each detail we found.
Is a visible WordPress version dangerous?
On its own, no. A version number doesn't let anyone into your site.
It matters because of what it can point to. WordPress's hardening guide explains that when a security fix is released, "the information required to exploit the vulnerability is almost certainly in the public domain," which "makes old versions more open to attack." If your site shows an old version, automated tools know what to try.
That's also why hiding the number isn't the fix. The same guide says security through obscurity "is generally an unsound primary strategy." The version can often be worked out other ways, such as from version numbers that appear in the addresses of script and style files. An up-to-date site with a visible version is in better shape than an outdated site with the version hidden.
How do I update WordPress safely?
Back up first. WordPress recommends a backup before updating so you can restore your site if something goes wrong. Many hosts take daily backups, so check that yours ran recently.
Then go to Dashboard → Updates and install everything available: WordPress itself, your theme and your plugins. Since version 3.7, most sites apply minor and security releases automatically, but major releases still need you to click "Update Now."
Next, turn on automatic updates for the plugins and themes you trust:
- On the Plugins screen, click the link in the "Automatic update" column for each plugin, or use the bulk action to switch on several at once.
- For a theme, go to Appearance → Themes, click the theme's thumbnail, and choose "Enable auto-updates."
- If those controls are missing, your host or a plugin may have turned them off. If auto-updates don't seem to run, WordPress suggests checking Tools → Site Health for errors.
Our WordPress security checklist covers updates along with logins, backups and the other basics.
How do I hide the version number?
Once you're up to date, remove the generator tag. If your report also lists server or PHP versions, hide those at your host or on your server.
Instructions for Security plugin
- 1Most WordPress security plugins have an option to hide the WordPress version or remove the generator tag. Look in the plugin's hardening or tweaks settings.
- 2Turn it on and save.
- 3Clear your caching plugin's cache so the change shows up.
See what else your website reveals
Run a free scan to check software versions, security headers, your SSL certificate and email settings in one plain-English report.
- Free check
- No signup
- No changes to your website
Why does the scan still show a version?
- Caching is the usual cause. Clear your caching plugin, then any cache at your host or CDN, and re-check.
- Some plugins and page builders add their own generator tag with a version number. View your page source, search for "generator," and look for that plugin's setting to turn it off.
- Server headers are separate from WordPress. If the report lists
ServerorX-Powered-By, those need the host or server changes above.
If your site is up to date and a version still shows, it's a low priority. Updates are what count.
What should you do next?
- Back up your site, then install every update under Dashboard → Updates.
- Hide the generator tag with a security plugin or the one-line snippet, and clear your cache.
- Run the free website security scan again to confirm the version is gone.
- Work through our WordPress security checklist for logins, backups and plugins.
- If you're worried an old version was already abused, read how to tell if your website has been hacked.
Common questions
Is showing my WordPress version a security hole?
Not by itself. It's a possible exposure. If your version is current, the number gives an attacker very little. If it's out of date, it points automated tools at known problems, which is why updating matters more than hiding it.
Will hiding the version stop hackers?
No. WordPress calls security through obscurity "generally an unsound primary strategy," and the version can often be worked out other ways. Hiding it removes an easy clue. Staying updated is what protects you.
Doesn't WordPress update itself?
Partly. Since version 3.7, most sites apply minor and security releases automatically. Major releases still need you to click Update Now. Plugins and themes only update automatically if you turn that on for each one.
Will removing the generator tag break anything?
No. Visitors won't see any difference. The tag is a single line in your page code that names the software that built the page, and nothing on your site depends on it.
Why does the scan still flag my site after I hid the version?
A cache is usually still serving the old page, so clear your caching plugin and any host or CDN cache. Some plugins and page builders also add their own generator tag with a version number, and your server may show versions in its headers.
Sources
- Hardening WordPress (WordPress Developer Resources)
- Updating WordPress (WordPress.org Documentation)
- Plugin and themes auto-updates (WordPress.org Documentation)
- wp_generator() (WordPress Developer Resources)
- the_generator hook (WordPress Developer Resources)
- Apache core features: ServerTokens (Apache HTTP Server Documentation)
- Module ngx_http_core_module (nginx.org)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.