A line of markup sitting quietly in every WordPress page's <head> tells anyone who looks exactly which version of WordPress is running, information that costs nothing to remove and gives an attacker a head start for nothing in return.
What this finding means
Crawl Cove's wp-generator-version-exposed check only runs on sites identified as WordPress, and it fires when a version string is captured from the <meta name="generator"> tag WordPress adds to every page by default.
A real finding looks like this:
WordPress version "6.4.2" is exposed via the generator meta tag.
This is a site-level finding: the same tag appears on every page WordPress serves, so it is reported once for the site rather than once per page.
Why it matters
Publishing the exact WordPress version tells anyone scanning the site, human or automated, which known vulnerabilities to try first. Security researchers publish version-specific WordPress vulnerabilities regularly, and an attacker running a mass scan across thousands of sites uses exactly this tag to sort targets by which known exploit might work. Hiding the version does not patch anything, but it costs nothing and removes one of the easiest signals a scanner relies on.
How to fix it
Add this to your theme's functions.php, or to a small site-specific plugin so it survives a theme change:
remove_action('wp_head', 'wp_generator');
That removes the tag from the page <head>. Some SEO and security plugins (Yoast SEO, Wordfence, and others) offer the same removal as a toggle in their settings if you would rather not edit theme files directly.
Re-crawl the site afterwards to confirm the tag, and the finding, are gone.
False positives and edge cases
- This check only ever runs on a site Crawl Cove has identified as WordPress. A non-WordPress site gets zero findings from this check.
- Removing this one tag does not hide every version signal. Themes and plugins can carry their own version markers in code comments inside CSS or JS files, in
readme.html, or in specific file paths that respond only on certain versions. This check covers the WordPress core generator tag specifically, not every possible fingerprint. - This is a low-severity, defence-in-depth fix, not a patch. It removes one easy signal; keeping WordPress core, themes and plugins updated is what actually closes known vulnerabilities.
Related reading
For the check that flags WordPress's XML-RPC interface being publicly reachable, a more direct brute-force and DDoS risk, see WordPress XML-RPC: Should xmlrpc.php Be Disabled?. For two other WordPress defaults worth changing, see WordPress Default Permalinks (?p=N URLs) and Open Uploads Directory Listing on WordPress.
WordPress documentation: Hardening WordPress
This is one of the checks in our step-by-step WordPress SEO audit guide.
Frequently asked questions
- Does hiding the version stop my site being hacked?
- No, it is not a substitute for keeping WordPress, themes and plugins updated. It removes one easy signal an automated scanner uses to pick its first target, but a determined attacker has other ways to fingerprint a WordPress version.
- Will removing this tag break anything?
- No. The generator meta tag has no functional purpose; it exists purely as a marker, so removing it changes nothing a visitor or search engine sees.
- Do plugins and themes have their own version tags too?
- Some do, in code comments inside their CSS or JS files rather than in a meta tag, and this specific check only covers the WordPress core generator tag. Hiding one does not hide the others.
- Why is this severity low if it helps attackers?
- It only exposes a version number, not a vulnerability by itself, and countless other signals (readme.html, specific file paths, response headers) can reveal the same information anyway. It is worth doing because it is free, not because it closes a serious hole on its own.