# Hide Plugin and Theme Versions in Asset URLs

> Replaces the ?ver= value on plugin and theme CSS and JavaScript files with a short hash, so scanners cannot read your exact plugin versions from the page source, while caches still refresh whenever a version changes.

- Type: PHP
- Runs: Frontend only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: fingerprinting, versions, hardening
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-hide-plugin-asset-versions/

## Code

```php
$wpide_hash_version = function ( $src ) {
    if ( ! is_string( $src ) || false === strpos( $src, 'ver=' ) || false === strpos( $src, '/wp-content/' ) ) {
        return $src;
    }

    $query = (string) wp_parse_url( $src, PHP_URL_QUERY );
    parse_str( $query, $args );

    if ( empty( $args['ver'] ) ) {
        return $src;
    }

    return add_query_arg( 'ver', substr( wp_hash( $args['ver'] . '|' . strtok( $src, '?' ) ), 0, 8 ), $src );
};

add_filter( 'style_loader_src', $wpide_hash_version, 9999 );
add_filter( 'script_loader_src', $wpide_hash_version, 9999 );
```

## Notes

Plugin readme files can still reveal versions; block access to readme.txt files on your server for full coverage.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Hide Plugin and Theme Versions in Asset URLs" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/