Security: Version

Reduces version disclosure in generator output and asset URLs.

Capabilities and extension points

Reduces version disclosure in generator output and enqueued asset URLs.

WordPress-routed readme and license requests are also blocked; files served directly by the web server do not pass through this policy.

Registers hooks for hiding version information.

Removes the default generator tag from the head.

Blanks the generator output for every context (RSS, Atom, etc.).

• return string

Replaces the `ver` query argument on an enqueued asset URL with a hash.

Removing the argument altogether would disable cache busting for every asset on the site, so the value is hashed instead. The hash is deterministic, which keeps browsers and proxies fetching a fresh copy whenever the underlying version changes, while no longer disclosing the WordPress, theme, or plugin version behind it.

Versions are left intact in the admin, where stale assets after an update are more of a problem than fingerprinting.

• param string $src Asset URL.
• return string Asset URL with a hashed version query argument.

Hashes an asset version with the site's own salts.

Uses WordPress authentication salts to produce a deterministic opaque cache token. This reduces casual version disclosure; it is not a confidentiality guarantee. Changing salts also changes these tokens.

Results are memoized because a single request runs this for every enqueued style and script.

• param string $version Asset version.
• return string Hashed asset version.

Rejects WordPress-routed URLs containing a readme or license filename.

Static files served directly by the web server bypass this hook.

Source reference

This editable reference page is based on the PHP documentation in security/class-version.php.