Meta Generator and Version Info Remover
This plugin will remove the version information that gets appended to enqueued style and script URLs. It will also remove the Meta Generator tag in the head and in RSS feeds. Adds a bit of obfuscation to hide the WordPress version number and generator tag that many sniffers detect automatically from view source. Option available to selectively exclude any style or script file from version info removal process. You can enable/disable each removal options from admin dashboard: Remove WordPress Meta Generator Tag Remove WPML (WordPress Multilingual Plugin) Meta Generator Tag Remove Slider Revolution Meta Generator Tag Remove WPBakery Page Builder Meta Generator Tag Remove Easy Digital Downloads Meta Generator Tag Remove Master Slider Meta Generator Tag Remove LayerSlider Meta Generator Tag Remove Site Kit by Google Meta Generator Tag Remove Divi Theme Meta Generator Tag (By default disabled; if required enable from Settings) Remove Elementor Website Builder Meta Generator Tag (By default disabled; if required enable from Settings) Remove Image Placeholders Meta Generator Tag Remove Performance Lab Meta Generator Tag Remove Performant Translations Meta Generator Tag Remove WEBP Uploads (Modern Image Formats) Meta Generator Tag Remove WP Admin Footer Version & Thank You Note (By default disabled; if required enable from Settings) Remove Version from Stylesheet Remove Version from Script Exclude files from version info removal process (by providing comma separated file names) Remove Yoast SEO comments Remove WP Rocket comments backlink and mention Remove Google Analytics (MonsterInsights) comments Remove Admin Bar WordPress Logo Remove Admin Login Page Logo Remove WordPress Text from Admin Login Page Title Remove WordPress Text from Admin Pages’ Titles Remove Admin Dashboard Help Tab You have any suggestions to make this plugin better? Please share your thoughts in the support thread. Dashboard > Settings > Meta Generator and Version Info Remover This plugin is trusted since 2013. If you like this plugin, please rate and review this plugin. If you want to support development of this plugin, please Donate.
Strict CSP
This plugin enforces a Strict Content Security Policy (CSP) on the frontend and login screen. This helps mitigate cross-site scripting (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see #59446). In #58664, the manual construction of script tags was eliminated from WP_Scripts and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in #39941. This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing tags. Some bundled WordPress core themes still do this incorrectly (which has been reported in Trac as #63806). For example, do not do this: function my_theme_supports_js() { echo ' document.body.classList.remove("no-js"); '; // ❌ } add_action( 'wp_footer', 'my_theme_supports_js' ); Instead, do this: function my_theme_supports_js() { wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅ } add_action( 'wp_footer', 'my_theme_supports_js' ); So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including wp_enqueue_script(), wp_add_inline_script(), wp_localize_script(), wp_print_script_tag(), wp_print_inline_script_tag(), and wp_enqueue_script_module(). Otherwise, a script’s execution will be blocked and an error will appear in the console, for example: Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list. This also blocks scripts inside of event handler attributes, such as onclick, onchange, onsubmit, and onload. As noted on MDN: Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies. This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the nonce attribute added.
