Hide My WP Ghost

Hide My WP Ghost is a WordPress security plugin focused on concealing standard paths and adding access, firewall, and bot controls. It is best suited to freelancers, site owners, developers, and agencies managing one or more self-hosted WordPress installations. The free tier is a credible starting point, while paid licenses make more sense when you need premium features, support, or coverage for several sites.

Overview

The plugin can move login and administration URLs and hide common WordPress paths without physically changing the site’s files or directories. That reduces the visibility of familiar entry points to bots and detectors without requiring a structural rewrite. Concealment is not a complete security strategy, but the surrounding controls give it practical value beyond simply changing a URL.

The product is now called WP Ghost; the maker says the renamed product retains the same security engine, team, and features. Setup is described as taking less than five minutes and requiring no coding knowledge, which suits owners who want a configuration-led WordPress security layer. The project also participates in Patchstack’s managed vulnerability disclosure program.

Key features

• Path protection: Login and admin URLs can be changed, while common paths are hidden without altering WordPress files or directories. This is useful for reducing routine automated discovery.
• Access defenses: Brute-force protection, two-factor authentication, XML-RPC controls, and IP allowlists and blocklists address several common access and abuse routes.
• Firewall and logging: The free plan includes 7G and 8G firewall protection, a security threats log with 30-day retention, and one-click presets. Those presets lower setup effort; the 30-day window is useful for recent incidents but is not a long-term audit archive.
• Authentication: Free two-factor authentication supports codes, email, and passkeys, giving small sites multiple second-factor options without a paid license.
• API and bot protection: API protection and bot management extend the plugin beyond login-page concealment, particularly for sites exposed to automated requests.
• Compatibility: It supports WordPress Multisite on subdirectories and subdomains and is described as tested with more than 1,000 themes and plugins. It also works with security plugins including Wordfence and Sucuri, and lists WPML and WP Rocket as integrations.

Pricing

The free version costs free and is a free WordPress plugin with 115+ free security features. It is the sensible choice for a single site needing basic path security, firewall protection, two-factor authentication, logging, and presets, but it does not include the paid tier’s all-premium feature set or priority email support.

• Ghost 1: $29 a year, billed $29.00/yr, for one website with all premium features and priority email support. It fits a freelancer or blog owner who needs the complete feature set on one installation.
• Ghost 5: $59.50 a year, billed $59.50/yr, covers five websites with premium features and priority email support. It targets small businesses and developers, trading the lower single-site price for a multi-site allowance.
• Ghost 5 LTD: $199, paid once, a one-time payment that never renews, for five websites with premium features and priority email support. It costs more upfront than one year of Ghost 5 but removes recurring renewal.
• Ghost 25: $249 a year, billed $249/yr, covers 25 websites with premium features and priority email support. This is aimed at larger portfolios rather than an individual site.
• Ghost All: $499 a year, billed $499/yr, allows unlimited websites with premium features and priority email support. It is the agency-oriented subscription for changing client counts.
• Ghost 25 LTD: $799, paid once, a non-renewing one-time payment for 25 websites, with premium features and priority email support.
• Ghost ALL LTD: $1,449, paid once, never renewing, covers 1,000 websites with premium features and priority email support. It is reserved for agencies with a very large managed portfolio.

Platforms

Hide My WP Ghost runs on self-hosted WordPress and is available as a web-managed plugin experience. Its Multisite support covers both subdirectory and subdomain configurations.

Who it's for

Choose it if your priority is reducing exposure of standard WordPress paths while keeping firewall, authentication, API, and bot controls in the same plugin. The free plan suits blogs and small sites testing that approach; Ghost 1 is tailored to freelancers, Ghost 5 to small businesses and developers, and Ghost All to agencies. It is less suitable if you need a general-purpose WAF unrelated to WordPress or long-term log retention.

Pros and cons

• Pros: Free access includes meaningful protections rather than path hiding alone; URL concealment does not alter core files; support for Multisite, major security plugins, and many themes and plugins broadens deployment options; lifetime plans avoid renewals.
• Cons: The free log lasts 30 days; premium features and priority support require a paid plan; one-site and five-site subscriptions can become limiting as a portfolio grows, requiring an upgrade.

Alternatives

For a broader web-application firewall directory, browse Web Application Firewall Software.

• Cloudbric is the better fit when you want coverage across Android, iOS, macOS, Windows, API, and web, plus a free VPN plan with one simultaneous connection.
• BitNinja suits VPS operators who need Linux and self-hosted coverage with resource-based VPS tiers.
• Fastly Image Optimizer is for API, Linux, or web image-request optimization rather than WordPress path security.
• BunkerWeb is an open-source, self-hosted WAF choice, with a PRO option using custom pricing.
• Gcore WAAP fits multi-domain web and API protection with request quotas and overage pricing.
• Haltdos offers community or paid WAF deployments for self-hosted, Linux, API, and web environments.
• ModSecurity is a free, open-source WAF engine that runs inside a web server on Linux, macOS, self-hosted, and Windows systems.
• OWASP Coraza WAF is another free, open-source self-hosted WAF for API, Linux, and macOS deployments.

Verdict

Hide My WP Ghost is a strong choice for WordPress owners who want path concealment combined with practical login, firewall, API, and bot defenses, especially when the free plan covers a single site. Pick a paid tier when premium features, priority support, or multi-site capacity matter. Look elsewhere if your workload is not WordPress-centric or if you need retention beyond 30 days and a broader standalone WAF.