https://github.com/thisismyurl/remove-generator-tag-for-wordpress
Removes the WordPress version meta generator tag from your site head — small security hardening with zero configuration.
https://github.com/thisismyurl/remove-generator-tag-for-wordpress
hardening meta-generator security wordpress wordpress-plugin wp-head
Last synced: about 2 months ago
JSON representation
Removes the WordPress version meta generator tag from your site head — small security hardening with zero configuration.
- Host: GitHub
- URL: https://github.com/thisismyurl/remove-generator-tag-for-wordpress
- Owner: thisismyurl
- License: gpl-2.0
- Created: 2026-04-26T12:32:35.000Z (2 months ago)
- Default Branch: main
- Last Pushed: 2026-05-20T21:24:45.000Z (about 2 months ago)
- Last Synced: 2026-05-21T03:16:02.257Z (about 2 months ago)
- Topics: hardening, meta-generator, security, wordpress, wordpress-plugin, wp-head
- Language: PHP
- Homepage: https://thisismyurl.com
- Size: 35.2 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Security: SECURITY.md
Awesome Lists containing this project
README
# WP Remove Generator Meta Tag
Single-file WordPress plugin that strips the WordPress version meta generator tag from your site head **and** every feed format.
[](https://wordpress.org/plugins/remove-generator-tag-for-wordpress/)
[](https://wordpress.org/plugins/remove-generator-tag-for-wordpress/#reviews)
[](https://www.gnu.org/licenses/gpl-2.0)
---
## Why this exists
I keep running into hardened WordPress sites where someone forgot to strip the generator tag, and version fingerprinting still gets sites compromised in 2026. I built this plugin for the same reason I built the first version of it back in 2010: it should already be a default in core, and it isn't.
Originally published 2010. Rewritten 2026 for current WordPress.
## What it does
- Removes `` from `` on every front-end page.
- Removes the generator string from every feed format WordPress emits — RSS2, RSS, RDF, Atom, comments feeds, OPML, and the Atom Publishing endpoint.
- Filters `get_the_generator_*` so SEO and security plugins that call the helper directly also receive an empty string.
## What it does *not* do
- Strip `?ver=X.Y.Z` from enqueued asset URLs. That has real cache-busting trade-offs and belongs in a separate plugin.
- Render an admin page, settings screen, or notices.
- Enqueue CSS, JS, or images.
- Phone home, log telemetry, or contact any third-party service.
Small, single-purpose plugin. No settings page, no admin chrome, no tracking. Activate it and it works. Deactivate it and it leaves no trace.
## Requirements
- WordPress 6.4 or later.
- PHP 7.4 or later.
## Installation
1. Install through the [WordPress plugin directory](https://wordpress.org/plugins/remove-generator-tag-for-wordpress/) or upload the plugin folder to `wp-content/plugins/`.
2. Activate it from **Plugins** in WordPress admin.
3. Reload any front-end page and search the HTML source for `generator`. The tag should be absent. Check `/feed/` the same way.
## How it works
```php
// In wp-remove-generator-meta.php
remove_action( 'wp_head', 'wp_generator' );
foreach ( $feed_hooks as $hook ) {
remove_action( $hook, 'the_generator' );
}
foreach ( $generator_filters as $filter ) {
add_filter( $filter, __NAMESPACE__ . '\\suppress_generator_string', 10, 0 );
}
```
The plugin hooks at boot — no `init`, no `wp_loaded`, no settings to read. WordPress core registers `wp_generator` and `the_generator` early in the request lifecycle, so detaching them at file load is the cheapest path. The `get_the_generator_*` filter set covers every helper variant (`html`, `xhtml`, `atom`, `rss2`, `rss`, `comment`, `export`) so anything calling the helper directly receives an empty string instead of the version.
## Development
```sh
composer install
composer run lint:phpcs
```
PHPCS runs against the WordPress-Extra ruleset with PHPCompatibilityWP set to PHP 7.4+. CI runs the same on every push. The plugin is one file; reading the source is the documentation.
## Changelog
See [`readme.txt`](readme.txt) for the full WordPress.org changelog.
## License
GPL v2 or later. See [LICENSE](LICENSE).
## Author
Built and maintained by Christopher Ross — 25 years working with WordPress, currently running a senior-dev consulting practice at This Is My URL. More plugins, writing, and case studies at [thisismyurl.com](https://thisismyurl.com/).
---
*This project follows the [10 Core Pillars](PILLARS.md). Support quality work [here](https://github.com/sponsors/thisismyurl).*