WordPress version disclosure: a small leak that makes you a precise target
Knowing your exact version turns opportunistic scanning into targeted exploitation. Hiding it raises the attacker’s cost — but the version being old is the actual problem.
Vigil flagged this because your site published its exact WordPress version — in the generator meta tag on the homepage, or in /readme.html. This is a warning-level finding: version disclosure is reconnaissance fuel, not a breach by itself.
Why it matters
Mass exploitation is a matching problem. A bot crawls the web, reads generator tags, and builds a list of sites running a version with a known, published CVE. If your version is visible and behind, you move from “one of millions” to “a confirmed match” — the bot now knows exactly which exploit to fire. Hiding the version doesn’t patch anything, but it denies the attacker that free, instant confirmation and forces them to spend effort fingerprinting you instead.
Hiding the version buys you time. Updating the version is what actually closes the hole.— the honest caveat
How to fix it
Do two things. Suppress the obvious version tells, and — far more importantly — keep the software current so a disclosed version wouldn’t matter anyway.
// functions.php or an mu-plugin — strip the generator version
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');
// Optional: drop the ?ver= query string that also leaks core/asset versions
add_filter('style_loader_src', 'vigil_strip_ver', 9999);
add_filter('script_loader_src', 'vigil_strip_ver', 9999);
function vigil_strip_ver($src) {
return $src ? remove_query_arg('ver', $src) : $src;
}# readme.html also prints the version — remove or block it
# nginx
location = /readme.html { deny all; return 404; }
# Apache / .htaccess
<Files readme.html>
Require all denied
</Files>Then turn on automatic updates for minor core releases and keep plugins patched — that’s the control that actually removes the risk. Hiding the version is defense-in-depth on top, not instead. Re-run the probe afterwards: the generator tag should be gone and /readme.html should 404.
Our team can apply this fix on your site and verify it with Vigil. Already monitoring this site with Vigil? Open the failing check and hit “Request a fix” — we’ll get the exact problem and URL. Otherwise, get in touch.