Skip to content
PluginCanary

Hide My WP Ghost

Hide My WP Ghost - Security & Firewall
by John Darrel · 100,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 3 Nov 2026, 37 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for Hide My WP Ghost
Ownership100
Maintenance100
Security60
Support57
Reputation85

How the score works

Quick answers

Is Hide My WP Ghost still maintained?
Yes. Last release 3 Nov 2026, 37 releases in the last 24 months. 3 Nov 2026 · wordpress.org
Who owns Hide My WP Ghost, and has it changed hands?
No change recorded. Main committer johndarrel since Jul 2016. 4 Nov 2026 · SVN log
Was Hide My WP Ghost removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Hide My WP Ghost safe?
15 known vulnerabilities, all fixed (latest in 7.0.13). Not on the exploited list. 15 Oct 2026 · Wordfence Intelligence
Is the latest Hide My WP Ghost update safe to install?
No ownership change before 7.0.16. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
johndarrel1 Jul 2016 to 3 Nov 2026, 1152 commits

1 committer recorded. No ownership change since 2016.

Maintenance

Last release
yesterday
Releases, 24 months
37
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Hide My WP Ghost
Q1 20241
Q2 202424
Q3 20241
Q4 20241
Q1 20250
Q2 20250
Q3 20251
Q4 20250
Q1 202617
Q2 20260
Q3 202614
Q4 20264

Last release 3 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (2 reviews). Lifetime: 4.5.

Average rating per quarter for Hide My WP Ghost
Q2 20245.0
Q3 20245.0
Q4 20245.0
Q1 20254.0
Q2 20254.0
Q3 20255.0
Q4 20253.5
Q1 20265.0
Q3 20265.0
Q4 20265.0

Average rating stayed at 5.0 between Q2 2024 and Q4 2026.

Rating distribution
5 star317
4 star5
3 star8
2 star9
1 star34
Latest low reviews

Security record

12 vulnerabilities in 24 months (15 on record), all patched (latest fixed in 7.0.13).

Show 15 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
15 Oct 2026Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content7.2<= 7.0.127.0.13Patched before disclosure
18 Sep 2026WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter4.7<= 7.0.027.0.03Patched before disclosure
16 Sep 2026Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Protection Mechanism Bypass5.3<= 7.0.107.0.11Patched before disclosure
16 Sep 2026Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Login Protection Bypass5.3<= 7.0.107.0.11Patched before disclosure
7 Sep 2026Hide My WP Ghost – Security & Firewall <= 7.0.09 - Unauthenticated Server-Side Request Forgery7.2<= 7.0.097.0.10Patched before disclosure
4 Aug 2026WP Ghost (Hide My WP Ghost) – Security & Firewall < 7.0.05 - IP Spoofing to Protection Mechanism Bypass5.3< 7.0.057.0.0514
23 Jul 2026WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass4.3<= 7.0.067.0.07Patched before disclosure
18 Mar 2026Hide My WP Ghost < 7.0.00 - Unauthenticated Open Redirect4.7< 7.0.007.0.00153
19 Mar 2025Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion9.8<= 5.4.015.4.02372
13 Mar 2025WP Ghost <= 5.4.01 - Unauthenticated Limited File Read7.5<= 5.4.015.4.02378
11 Feb 2025Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure5.3<= 5.3.025.4.01408
14 Nov 2024Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL6.1<= 5.3.015.3.02Patched before disclosure
2 Jul 2024Hide My WP Ghost – Security & Firewall <= 5.2.01 - Login Page Disclosure5.3<= 5.2.015.2.02632
22 Aug 2023Hide My WP Ghost <= 5.0.25 - CAPTCHA Bypass in brute_math_authenticate5.3<= 5.0.255.0.26947
8 May 2023Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass6.5<= 5.0.185.0.20362

Changelog mentions of security fixes: 7.0.09 (security, vulnerability); 7.0.03 (security); 7.0.00 (security, vulnerability, XSS, SQL injection); 7.0.10 (security); 7.0.11 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

57% of 7 support threads resolved in the last 2 months.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Hide My WP Ghost
4 May 20262,314
11 May 202625,302
18 May 20266,576
25 May 20263,784
1 Jun 202624,896
8 Jun 20264,373
15 Jun 20263,577
22 Jun 20262,888
29 Jun 20262,628
6 Jul 202623,333
13 Jul 202625,064
20 Jul 202626,297
27 Jul 202625,312
3 Aug 20266,252
10 Aug 20263,438
17 Aug 202624,930
24 Aug 20264,864
31 Aug 202623,198
7 Sep 20267,696
14 Sep 202626,127
21 Sep 20265,926
28 Sep 202623,056
5 Oct 202624,427
12 Oct 202622,132
19 Oct 20268,349
26 Oct 202642,276
2 Nov 20261,548

Weekly downloads over the last 4 weeks are 25% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

IP Location BlockScore 96 · 10,000+Wordfence SecurityScore 94 · 5,000,000+Sucuri SecurityScore 93 · 600,000+WP Content Copy Protection & No RightScore 93 · 100,000+Disabled Source, Disabled Right ClickScore 93 · 10,000+

Facts

Version7.0.16
AuthorJohn Darrel
Added1 Jul 2016
Last updated3 Nov 2026
Active installs100,000+
Requires WordPress5.8
Tested up to7.1.4
Requires PHP7.4
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tagslogin, firewall, security, hide my wp, Brute Force

Other plugins by this author: Website Security Check

Questions

Is Hide My WP Ghost still maintained?

Yes. Last release 3 Nov 2026, 37 releases in the last 24 months.

Who owns Hide My WP Ghost, and has it changed hands?

No change recorded. Main committer johndarrel since Jul 2016.

Was Hide My WP Ghost removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Hide My WP Ghost safe?

15 known vulnerabilities, all fixed (latest in 7.0.13). Not on the exploited list.

Is the latest Hide My WP Ghost update safe to install?

No ownership change before 7.0.16. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue