Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Hide My WP Ghost · Version history

Hide My WP Ghost changelog and version history

Latest version
7.0.17
Nov 7, 2026 (1 day ago)
Releases
20
since 2020
In the last year
14
about one every 26 days
Tested up to
WordPress 7.1.4
PHP 7.4 or later

Releases each year

  • 20201 release
  • 20221 release
  • 20243 releases
  • 20252 releases
  • 202613 releases

202613 releases

  1. Hide My WP Ghost 7.0.17Latest

    • Update – Two-factor login reads the real visitor IP behind a proxy
    • Update – Hide IDs from META Tags keeps the template IDs WooCommerce needs
    • Update – Mapped CSS and JS files load in full on the first visit
    • Update – Header Security drops the deprecated X-XSS-Protection header
    • Update – Nginx setup notice appears only when there are rules to add
    • Update – Two-factor login falls back to a method the user has set up
    • Update – Plugins page asks before deactivating, which resets the settings
    • Update – Text Mapping keeps pages scrolling on sites that load Bootstrap
    • Update – Upgrade popup lists the Premium features and pricing
    • Update – Rollback card installs the current or a previous stable version
    • Update – AI assistant sign-ins work with Squirrly SEO, WP Rocket and Imagify
    • Update – Translations cover the new texts

  2. Hide My WP Ghost 7.0.16

    • Update – Whitelisted IPs are trusted across all firewall rules
    • Update – Firewall path checks respect custom admin and login paths
    • Update – Path settings reject weak or duplicate custom names so every path stays safe and unique
    • Update – Remove Unsafe Headers moved to the Header Security section
    • Update – Cleaner firewall settings layout on mobile

  3. Hide My WP Ghost 7.0.15

    • New – 2026 Ghost Firewall: the new firewall generation with the latest 2026 threat protection, covering admin-ajax, the REST API, file uploads and more
    • Update – The plugin verifies the SSL certificate on its own path and security check requests
    • Update – Firewall checks comment and form submissions on levels 3 and 4
    • Update – Password and payment fields stay private in the threat log
    • Update – Country database saved in the uploads folder and downloaded in the background
    • Update – Security Check warns about PHP2Shell
    • Update – Translated the new texts in all bundled languages

  4. Hide My WP Ghost 7.0.14

    • Update – Security update: Hide Source Map References works only inside inline scripts and styles
    • Fix – Firewall level 2 no longer blocks visitors from Facebook, Instagram and Google Ads when the fbclid or gclid token contains x1b, x20 or null.
    • Fix – Firewall level 4 checks its short malware-name list on the URL path only, so random fbclid and gclid tokens no longer match it.
    • Fix – Whitelisting a firewall rule now skips only that rule, and the other rules still check the request.
    • Fix – The two-factor and Magic Login screens no longer stop with a PHP error on WordPress versions before 6.4.
    • Update – Translated the new texts in all bundled languages: Arabic, Chinese, Dutch, Finnish, French, German, Indonesian, Italian, Japanese, Portuguese, Romanian, Russian, Spanish and Turkish.

  5. Hide My WP Ghost 7.0.13

    • New – Weekly email summary of blocked threats, logins and blocked IPs. Turn it on or off in Advanced, Notifications.
    • New – Check your reCAPTCHA keys on the Brute Force page without logging out.
    • New – WooCommerce checkout protection limits repeated checkout attempts and failed payments from the same IP, to stop card testing.
    • New – Email alert when the activity log or the threats log is turned off.
    • Update – reCAPTCHA v2 keeps the login button disabled until the box is checked.
    • Update – Right-click, copy and paste protection now skips form fields, so visitors can fill and paste in forms.
    • Update – Firewall and brute force now run on requests with an unverified login cookie, so a forged cookie cannot skip them.
    • Update – 6G firewall now also checks the query string on browser requests.
    • Update – The login math question uses a one time token, so an answer cannot be reused.
    • Fix – Temporary Login and Magic Login links expire correctly on PHP 8.
    • Fix – A corrupted firewall whitelist no longer causes a fatal error.

  6. Hide My WP Ghost 7.0.12

    • New – Random Static Number now has a Random Number Type option: a random version for each file that changes when the file version changes
    • Fix – reCAPTCHA V3 and Enterprise now add their token to login forms built with page builders like Elementor
    • Fix – reCAPTCHA V3 and Enterprise no longer change or resubmit other forms on the same page
    • Fix – With WooCommerce Support turned off, the WooCommerce login is no longer refused with “Invalid ReCaptcha”
    • Fix – CSS and JS files served by the plugin now send a valid Content-Type header
    • Fix – Random Static Number no longer saves a new number in the database on every page view of a logged in user
    • Fix – Hide Source Map no longer cuts off the page when a cache plugin like LiteSpeed Cache minifies the HTML

  7. Hide My WP Ghost 7.0.11

    • Update – Security update: the WooCommerce AJAX and API exceptions now confirm the request names a real WooCommerce action and arrives on the WooCommerce endpoint, and no longer reveal a hidden URL
    • Fix – The custom REST API path is now used during scheduled tasks, so plugins that renew a connection in the background, like FluentSMTP with Microsoft 365, no longer fail

  8. Hide My WP Ghost 7.0.10

    • Update – Security update: the compatibility exceptions for WooCommerce, WPML and MainWP now confirm the request really comes from those plugins before the plugin steps aside
    • Update – Security update: compatibility paths are matched from the site root, so an address that only contains a known path no longer matches
    • Update – Security update: the iThemes/Solid Security loopback exception now requires that plugin to be active and a matching verification value
    • Update – Security update: Temporary Login and Magic Login make the login page reachable only once the token matches a real user
    • Update – Security update: the page builder preview exception now requires editing rights, and the logged in check during early load is stricter
    • New – One click login support for the hosting panels: Softaculous (cPanel, CentOS Web Panel, DirectAdmin, Webuzo, Plesk) and aaPanel WP Toolkit
    • Update – Security update: hardening for the way the plugin resolves and handles the current request
    • Fix – CSS and JS are compressed only with what the browser actually accepts, instead of always answering compressed
    • Fix – Compressed responses now use gzip, which every browser and CDN reads the same way
    • Fix – Static files and the REST API path are now handled correctly when your site is reached on an alias domain
    • Fix – REST API responses handled by the plugin no longer carry compression headers that do not match the returned content
    • Fix – LiteSpeed: the QUIC.cloud address list is refreshed on its own and no longer kept forever, so QUIC.cloud keeps working as their addresses change
    • Fix – LiteSpeed: the QUIC.cloud addresses are loaded even when the plugin settings have not been saved since LiteSpeed was installed
    • Fix – Defender Security: the free edition of the plugin is now recognized, not only the Pro edition
    • Fix – Ghost Doctor no longer reports the CSS and JS files as not loading when Text Mapping in CSS and JS files is on and WordPress serves those files on purpose
    • Fix – Ghost Doctor now checks the REST API path the way WordPress answers it, instead of reporting a working REST API as missing
    • Fix – Changing the REST API path takes effect on save, without having to open Settings > Permalinks and save again
    • Fix – No longer stops with a fatal error on servers where the getallheaders() function is missing
    • Fix – Frontend Check no longer shows the word “undefined” at the end of the results when a path or an asset fails
    • New – New hmwp_files_allowed_hosts, hmwp_files_request_headers, hmwp_files_response_headers, hmwp_files_skip_headers, hmwp_files_cache, hmwp_files_cache_dir and hmwp_files_cache_lifetime filters for developers

  9. Hide My WP Ghost 7.0.09

    • New – AI Security Explanations: every finding on the Security Check page explained for your own website, in plain language
    • New – AI Security Explanations rank your findings by what actually exposes your site, using your server type, your rules and your security mode
    • New – A plain-language summary of your whole website, above the list of what to fix
    • New – Open Details on any finding to read why it matters on your server and what an attacker would do with it
    • Fix – Fix it now works for the Security Check tasks that change a plugin setting, such as Hide Old Paths, Hide Common Files, Hide wp-login and Disable XML-RPC
    • Fix – Fix it no longer answers with “Ajax is not loading correctly. Clear all cache and try again.” after the paths have been changed
    • Fix – The Security Check summary now shows whether your paths are working instead of always reporting that they have not been checked
    • Update – Published a coordinated vulnerability disclosure policy (SECURITY.md), a list of the third-party components we bundle (sbom.json), and a declared 5 year security update period

  10. Hide My WP Ghost 5.5.04

    • Update – Firewall rules on WP core init
    • Update – Added compatibility with Photo Gallery from 10Web
    • Fix – Security Check to update the options and handle properly
    • Fix – Small bugs

  11. Hide My WP Ghost 7.0.08

    • New – Ghost Doctor: finds what is breaking your paths and repairs it in one click
    • New – Ghost Doctor can switch to protection that needs no server rules when your server will not serve them
    • New – Security Check now opens with one prioritized list of what to fix first
    • New – Change Paths shows one card after a path change instead of three
    • Fix – Security Check no longer reports wp-content, the login path or the admin path as visible on sites that are hiding them correctly
    • Fix – Frontend check no longer reports a failure when Disable REST API Access is on
    • Fix – Open on a failing path check no longer leads to a 404 while the new paths are not working yet
    • Fix – Security Tasks no longer shows an empty table when every task passed
    • Fix – Last check now shows how long ago the scan ran, not a clock time

  12. Hide My WP Ghost 7.0.07

    • Security – Two-Factor Authentication settings are now bound to the account they belong to, so the 2FA method, authenticator, email codes, backup codes and passkeys can only be managed by the account owner or by an administrator allowed to edit that user
    • Security – Passkey enrollment is now always self-service, corresponding to the device the passkey is created on
    • Security – Temporary Login updates and deletions now apply only to temporary accounts, so regular accounts are never affected from this screen
    • Security – The role assigned to a temporary login is now validated and can never grant more capabilities than the user creating it already has
    • Security – Magic Login links now require the same permissions as the screen they are offered from

  13. Hide My WP Ghost 7.0.06

    • Fix – Editing a custom post type that uses the built-in Categories/Tags taxonomy no longer crashes the Block Editor
    • Fix – Block Editor no longer crashes with “Cannot read properties of undefined” when Hide User Enumeration is on
    • Fix – Settings page navigation menu no longer loses its layout on sites where another plugin or theme restricts the allowed HTML tags

20252 releases

  1. Hide My WP Ghost 5.4.07

    • Update – Compatibility with the plugin WP Social & WP Social PRO
    • Update – Compatibility with LiteSpeed Quic Cloud on IPV6
    • Update – Make REST API test work when permalinks are set to the default PHP parameter
    • Update – Minimum PHP version required is 8.0 in the Security Check section
    • Update – Added New Feature Two-factor Authentication By Passkey (2FA)
    • Update – Whitelist more known AI Chatbots in firewall rules

  2. Hide My WP Ghost 5.3.02

20243 releases

  1. Hide My WP Ghost 5.2.04

  2. Hide My WP Ghost 5.1.03

  3. Hide My WP Ghost 5.0.29

20221 release

  1. Hide My WP Ghost 4.1.11

20201 release

  1. Hide My WP Ghost 4.0.11

Questions about Hide My WP Ghost’s releases

What is the latest version of Hide My WP Ghost?

7.0.17, released on Nov 7, 2026 (1 day ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.

How often is Hide My WP Ghost updated?

14 releases in the last year, about one every 26 days. Its first release on WordPress.org dates from September 2020.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Hide My WP Ghost’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.