Your website shows which WordPress version it runs: before and after

Most WordPress sites print a line into every page's source code that names the exact WordPress version, for example "WordPress 6.2.1". Visitors never see it, but anything that reads the page source does, including the automated tools that look for sites running a version with a known security hole. In a check of 43,077 small-business home pages, 5,398 (12.5%) published their WordPress version this way, and 897 of those showed a version that was older than 6.0 or behind the security releases for its own branch.

First, the part that matters more

Hiding the version number is a small step. It removes the easiest label, but a determined tool can often still guess the version from other files. What actually protects the site is running a current, patched WordPress. So check that first: in the dashboard go to Dashboard, Updates. If it offers a newer version, take a backup and update before anything else. If the site is years behind or you are afraid an update will break it, there is a separate guide: updating an old WordPress without breaking it.

Check your own site

Open your home page on a computer, right-click and choose "View page source" (or press Ctrl+U, Cmd+Option+U on a Mac), then search the page (Ctrl+F) for generator. A line that says "WordPress" followed by a number is the one this guide removes. You may also see generator lines from page-builder or slider plugins with their own version numbers; the same advice applies to those plugins: keep them updated.

Remove the line

Through a plugin you already have: many security and optimisation plugins have a setting to remove the WordPress version. Look through the settings of the one you use before adding code.
Through code: add these two lines to a code-snippets plugin, or to the functions.php of a child theme (not the main theme, or the next theme update removes them). The second line also removes the version from the site's RSS feed.

remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

Then clear the cache. If the site uses a caching plugin or the host caches pages, the old source keeps being served until that cache is cleared. Check the page source again afterwards.

Not on WordPress?

Wix, Squarespace and Shopify keep their own software up to date for you, so there is no version for you to hide or update. This check only flags sites that say they run WordPress.

The page source above is a mock-up for a fictional business built for this demo. The 43,077-site figure comes from our own scan of small-business home pages in 2026: a site was counted when its home page carried a <meta name="generator"> tag naming WordPress. A version was counted as behind when it was older than 6.0, or when it was two or more security releases behind the newest release of its own branch on WordPress.org. More before/after examples: all demos.