{
    "title": "HTML comments and generator tags: erase the traces of WordPress",
    "seo_title": "Remove WordPress generator tags and plugin HTML comments",
    "h1": "HTML comments and generator tags: erase the traces of WordPress",
    "description": "Yoast, Site Kit, Elementor and your cache plugin sign your pages, often with their version. What they print, how to remove it, how to check.",
    "lead": "SEO, analytics and cache plugins and page builders sign the source code with their name and version. The list plugin by plugin, how Masquerade Security removes it, the limits and how to check.",
    "language": "en",
    "locale": "en-US",
    "type": "article",
    "url": "https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/",
    "canonical": "https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/",
    "markdown": "https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/index.md",
    "json": "https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/index.json",
    "published": "2026-10-28T13:00:00+00:00",
    "modified": "2026-11-05T20:54:52+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "HTML comments and generator tags: erase the traces of WordPress",
            "url": "https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/",
            "markdown": "https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/html-comments-generator-tag-wordpress/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Commentaires HTML et balise generator : effacer les traces de WordPress",
            "url": "https://www.wp-masquerade.com/fr/commentaires-html-balise-generator-wordpress/",
            "markdown": "https://www.wp-masquerade.com/fr/commentaires-html-balise-generator-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/fr/commentaires-html-balise-generator-wordpress/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Comentarios HTML y etiqueta generator: borra las huellas de WordPress",
            "url": "https://www.wp-masquerade.com/es/comentarios-html-etiqueta-generator-wordpress/",
            "markdown": "https://www.wp-masquerade.com/es/comentarios-html-etiqueta-generator-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/es/comentarios-html-etiqueta-generator-wordpress/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "HTML-Kommentare und Generator-Tag: WordPress-Spuren entfernen",
            "url": "https://www.wp-masquerade.com/de/html-kommentare-generator-tag-wordpress/",
            "markdown": "https://www.wp-masquerade.com/de/html-kommentare-generator-tag-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/de/html-kommentare-generator-tag-wordpress/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Commenti HTML e tag generator: cancellare le tracce di WordPress",
            "url": "https://www.wp-masquerade.com/it/commenti-html-tag-generator-wordpress/",
            "markdown": "https://www.wp-masquerade.com/it/commenti-html-tag-generator-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/it/commenti-html-tag-generator-wordpress/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Comentários HTML e tag generator: apague os rastros do WordPress",
            "url": "https://www.wp-masquerade.com/pt/comentarios-html-tag-generator-wordpress/",
            "markdown": "https://www.wp-masquerade.com/pt/comentarios-html-tag-generator-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/pt/comentarios-html-tag-generator-wordpress/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "HTML-opmerkingen en generator-tag: wis de sporen van WordPress",
            "url": "https://www.wp-masquerade.com/nl/html-opmerkingen-generator-tag-wordpress/",
            "markdown": "https://www.wp-masquerade.com/nl/html-opmerkingen-generator-tag-wordpress/index.md",
            "json": "https://www.wp-masquerade.com/nl/html-opmerkingen-generator-tag-wordpress/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "HTML comments and generator tags: erase the traces of WordPress"
        },
        {
            "level": 2,
            "text": "What plugins print in your source code"
        },
        {
            "level": 2,
            "text": "Why these traces matter"
        },
        {
            "level": 2,
            "text": "What Masquerade Security removes, plugin by plugin"
        },
        {
            "level": 2,
            "text": "How it is removed: the official setting first"
        },
        {
            "level": 2,
            "text": "What is deliberately kept"
        },
        {
            "level": 2,
            "text": "The limits to know"
        },
        {
            "level": 2,
            "text": "Check your own site"
        },
        {
            "level": 2,
            "text": "Turn the feature on"
        },
        {
            "level": 2,
            "text": "Free or Pro"
        },
        {
            "level": 3,
            "text": "Key takeaways"
        },
        {
            "level": 2,
            "text": "Sources"
        },
        {
            "level": 2,
            "text": "WordPress security, without the noise",
            "id": "wpm-nl-box-title"
        }
    ],
    "body": "Open the source code of your home page: chances are you will read “This site is optimized with the Yoast SEO plugin v28.8”, “Site Kit by Google 1.190.0” or “Elementor 4.3.5”. These signatures name plugins that only exist for WordPress, often with their version number. This article lists what common plugins print in your pages, explains how Masquerade Security (free version) removes it and how to check it yourself.\n\n## What plugins print in your source code\n\nTwo kinds of traces hide in the HTML every visitor receives:\n\n- **The generator tag**: `<meta name=\"generator\" content=\"...\">`, defined by HTML to name the software that produced the page. WordPress puts its version there, and so do Site Kit, Elementor and WooCommerce.\n- **HTML comments**: `<!-- ... -->`, invisible on screen but readable in the source code. SEO plugins wrap their tags in them, analytics plugins sign their tracking code, and cache plugins note which tool stored the page.\n\n![Two excerpts of the same HTML head. Before masking: comments from Yoast SEO 28.8 and Site Kit, generator tags for WordPress, Site Kit by Google 1.190.0 and Elementor 4.3.5, highlighted in red. After masking: only the title, the Google script and the Joomla! generator tag remain, highlighted in green.](https://www.wp-masquerade.com/media/2026/10/code-source-avant-apres-en.webp)\n\n*The same head, as an anonymous visitor sees it, without and then with masking (simplified excerpt).*\n\nThese lines are of no use to any visitor. Several developers provide a filter to remove them, but rarely a visible option.\n\n## Why these traces matter\n\nDetection tools read exactly these lines. As we explained in [our article on WordPress fingerprinting](https://www.wp-masquerade.com/wordpress-fingerprinting-detection/), a single signal is enough to convince them:\n\n- **They reveal WordPress.** In the Wappalyzer definitions (webappanalyzer project), the Yoast SEO comment alone leads to WordPress. An Elementor or Site Kit generator tag says it just as clearly: these plugins only exist for WordPress.\n- **They give version numbers.** The same definitions extract the version of Yoast SEO, Elementor and Site Kit. An exact version can be matched against public vulnerability databases in seconds, which is why you should monitor your plugins for vulnerabilities.\n- **They list your plugins without any extra request.** WPScan has a dedicated finder that reads every HTML comment on the page and compares them with the known patterns of each plugin.\n- **They contradict the imitation.** A site that announces Joomla! in its generator tag but keeps a Rank Math comment is unmasked by anyone curious enough to view the source.\n\nRemoving these traces fixes no vulnerability: it reduces what bots learn from a simple visit. We cover what masking can and cannot do in hiding WordPress: what it does and what it does not.\n\n## What Masquerade Security removes, plugin by plugin\n\nHere are the traces the free version removes, checked in each plugin’s code and, for the rows marked “tested”, on a live site. In the “Removed by” column, “official” means the setting provided by the developer and “filter” means the output filter described below.\n\n| Plugin | Trace removed | Removed by | Cached pages |\n| --- | --- | --- | --- |\n| Yoast SEO (tested, 28.8) | Comments `optimized with the Yoast SEO plugin v{version}`, Premium included | Official, filter as a fallback | Clean |\n| Rank Math (tested) | Comments `Search Engine Optimization by Rank Math`, even translated | Official and filter | Clean |\n| All in One SEO | Generator `All in One SEO (AIOSEO) {version}` and comments | Official (tag), filter (comments) | Clean |\n| The SEO Framework | Comments `The SEO Framework by Sybre Waaijer`, even translated | Official and filter | Clean |\n| Site Kit by Google (tested, 1.190.0) | Generator `Site Kit by Google {version}`, comments `added by Site Kit` | Official (tag), filter (comments) | Clean |\n| MonsterInsights, ExactMetrics, GTM4WP, Matomo, Meta pixels, Jetpack | Signed comments, with the version for MonsterInsights and ExactMetrics | Filter | Clean |\n| WP Statistics, Complianz | Signed comments | Official and filter | Clean |\n| WP Super Cache (tested) | `Cached page generated by WP-Super-Cache`, `Dynamic page generated in...` | Official (like unticking “Cache Status Messages”) | Clean, cache file checked |\n| LiteSpeed Cache (tested, 7.9.2) | `Page cached by LiteSpeed Cache {version}`, `Page optimized by LiteSpeed Cache` | Official and cache plugin’s last filter | Clean |\n| W3 Total Cache, WP Fastest Cache, WP-Optimize | Signed cache comments | Official (and filter for WP-Optimize) | Clean (WP-Optimize: except with WP_DEBUG) |\n| Hummingbird | `cached by the Hummingbird Performance plugin v{version}` | Cache plugin’s last filter | Clean |\n| WP Rocket | `This website is like a Rocket... WP Rocket` | Official constant | Replaced by a generic text |\n| Breeze | `Cache served by breeze CACHE` | Not removed | No |\n| Elementor (tested, 4.3.5) | Generator `Elementor {version}; features: ...; settings: ...` | Official (“Generator Tag”, saved setting untouched) and filter | Clean |\n| WPBakery, Slider Revolution, Divi, Redux | Generator with the name and often the version | Filter | Clean |\n| WooCommerce, WPML | Generator `WooCommerce {version}`, `WPML ver:{version}` | Identity module (WooCommerce), filter (WPML) | Clean |\n| WordPress itself | Generator, comments mentioning WordPress, wp-content, wp-json... | Identity module and filter | Clean |\n\n*WPBakery strings come from its documentation; those of Slider Revolution and Divi could not be checked in the code. SEOPress and Slim SEO print nothing public.*\n\nOther names are recognized as a precaution, without being checked one by one in the code: Avada, Oxygen, Bricks, Beaver Builder, Astra, Kadence, Smush or Polylang, for example.\n\n## How it is removed: the official setting first\n\nThe plugin applies three methods, in this order:\n\n1. **Each plugin’s official setting**: a filter, option or constant provided by its developer (for example `wpseo_debug_markers` for Yoast SEO or `litespeed_comment` for LiteSpeed Cache). This is the most reliable method, and it also applies to the page the cache stores. Your saved settings do not change.\n2. **An output filter** on the HTML page, for everything that has no setting. It only touches public pages requested with GET or HEAD (not the admin, AJAX, the REST API, feeds, sitemaps or [robots.txt](https://www.wp-masquerade.com/glossary/robots-txt/)). Above 4 MB or on any error, the page is sent unchanged.\n3. **The cache plugin’s last filter**, for LiteSpeed Cache and Hummingbird, which add their comment after the output filter.\n\nThe order matters: in our tests without the official settings, the output filter alone removed the traces of Yoast SEO, Rank Math, Site Kit and Elementor, but not those of LiteSpeed Cache, which are added after it. Detection relies on brand names, not sentences, so comments translated by Rank Math, Site Kit or The SEO Framework are removed too.\n\n![Two-part diagram. At the top, the three methods in order: the plugin’s official setting, an output filter on the page, the cache plugin’s last filter for LiteSpeed Cache and Hummingbird. At the bottom, three columns: what is removed (generator tags, signed comments, including translated ones), what is kept (imitated generator, scripts and JSON-LD, conditional comments, cache markers, neutral comments unless the option is on) and what is out of scope (Breeze, WP Rocket’s generic comment, pages already cached, HTTP headers, CSS classes, file URLs).](https://www.wp-masquerade.com/media/2026/10/traces-retirees-gardees-en.webp)\n\n*Three methods, in this order, and the line between what is removed, kept or out of scope.*\n\n## What is deliberately kept\n\nSo that nothing breaks, these stay in place:\n\n- the generator tag of the imitated software (Identity module level 2 and above), for example `Joomla! - Open Source Content Management`;\n- the whole content of `script` ([JSON-LD](https://www.wp-masquerade.com/glossary/structured-data/) included), `style`, `pre`, `textarea`, `svg` and `template` tags;\n- Internet Explorer conditional comments (`<!--[if ...]>`);\n- the markers cache plugins need: `noptimize`, `mfunc`, `mclude`, `dynamic-cached-content`, `esi`;\n- your theme’s neutral comments (“.site-header”, “Main navigation”), unless you tick the option described below.\n\n## The limits to know\n\n- **Breeze** writes its comment into its cache file, with no filter or setting: it stays.\n- **WP Rocket** does not allow its comment to be removed: it becomes `<!-- Cached for great performance -->`, with no plugin name and no WordPress.\n- **Pages already cached** before activation keep their comments until the cache is purged.\n- **Server caches and CDNs** (Varnish, Cloudflare, host cache) serve the stored page: it is clean if it was stored after activation, but their HTTP headers remain.\n- **Anything that is neither a comment nor a generator tag** is out of scope: HTTP headers (`X-LiteSpeed-Cache`, `cf-edge-cache: cache,platform=wordpress` from Cloudflare APO), CSS classes (`elementor-`, `woocommerce`, `yoast-schema-graph`), JavaScript variables, JSON-LD content, file URLs and the `?ver=` parameter.\n- **Logged-in visitors** see the site without masking.\n\nAbove all, keep this in mind: as long as `/wp-content/plugins/...` URLs remain in the page, Wappalyzer recognizes WordPress. Removing comments mostly removes names and versions; to go further, the [file URL aliases](https://www.wp-masquerade.com/features/file-url-aliases/) of WP Masquerade Pro rename those paths.\n\n## Check your own site\n\nRun the test before and after activation, always as an anonymous visitor:\n\n1. Open a private browsing window, logged out of WordPress.\n2. View the source code of the home page and of a post (Ctrl+U, or Cmd+Option+U on a Mac).\n3. Search (Ctrl+F) for `<!--`, then `name=\"generator\"`, then the names of your plugins.\n4. Reload the page: the first visit often fills the cache, the second shows the page served from the cache.\n\nFrom the command line:\n\n```\ncurl -s https://www.example.com/ | grep -n -E \"<!--|name=\\\"generator\\\"\"\n```\n\nOnly the imitated software’s tag, conditional comments, cache markers and, without the option, your theme’s neutral comments should remain. The video below shows what a curious visitor spots.\n\n*How to recognize a WordPress site in a few seconds (in French).*\n\n## Turn the feature on\n\n1. Open **Masquerade Security** (the mask icon in the admin menu).\n2. Choose a mode (Essential, Recommended or Maximum) or set the Identity module to at least level 1 (“Hide WordPress”): traces are removed from that level on.\n3. Turn on the “Masking on” switch and save.\n4. Optional: in the Identity tab, tick “Remove all HTML comments from public pages”. Off by default, this option also removes neutral comments, but keeps conditional comments, cache markers and the cover comment (level 4, Pro).\n5. Click **Purge caches** (Diagnostics tab), also clear your host or [CDN](https://www.wp-masquerade.com/glossary/cdn/) cache, then check.\n\nThe built-in purge covers LiteSpeed Cache, WP Super Cache and WP Rocket; host-specific details are on the [host and cache compatibility](https://www.wp-masquerade.com/features/hosting-and-cache-compatibility/) page.\n\n## Free or Pro\n\nRemoving plugin traces is part of the free version, with no limit or licence key. WP Masquerade Pro takes care of the other signals:\n\n| Feature | Free | Pro |\n| --- | --- | --- |\n| Plugin HTML comments and generator tags removed | Yes | Yes |\n| “Remove all HTML comments” option | Yes | Yes |\n| WordPress generator removed, another software’s tag | 5 profiles or a custom name | 41 profiles |\n| RSD, Windows Live Writer and shortlinks removed | Yes | Yes |\n| REST API announcement (tag and HTTP Link header) and oEmbed discovery removed | No | Yes |\n| File URL aliases (`/wp-content/`, `/wp-includes/`) | No | Yes |\n| Markers recognized by Wappalyzer and cover comment of the imitated software | No | Yes |\n\n*Features related to the traces of WordPress.*\n\nDetails on [technical links](https://www.wp-masquerade.com/features/wordpress-technical-links/), [imitating another CMS](https://www.wp-masquerade.com/features/cms-imitation/) and in the [comparison](https://www.wp-masquerade.com/free-vs-pro/). [Download the free version](https://www.wp-masquerade.com/download/) or [see Pro pricing](https://www.wp-masquerade.com/pricing/), from €59 per year excl. VAT.\n\n### Key takeaways\n\n- Yoast SEO, Site Kit, Elementor and cache plugins sign your pages, often with their version.\n- The Yoast SEO comment alone lets Wappalyzer conclude WordPress, and WPScan reads HTML comments to list your plugins.\n- Masquerade Security, free, removes them from level 1 of the Identity module: official setting first, output filter next.\n- Limits: Breeze, WP Rocket (generic text), pages already cached (purge), HTTP headers, file URLs.\n- Check in a private window: search the source code for `<!--` and `generator`.\n\n## Sources\n\n- WordPress Developer: get_the_generator() (https://developer.wordpress.org/reference/functions/get_the_generator/)\n- MDN: the meta name attribute, generator value (https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/name)\n- WordPress.org: Yoast SEO (https://wordpress.org/plugins/wordpress-seo/)\n- WordPress.org: Site Kit by Google (https://wordpress.org/plugins/google-site-kit/)\n\nOther sources consulted: official vendor pages.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.",
    "categories": [
        "Hardening"
    ],
    "format": "application/json"
}