Hide WP Surface

Hides the WordPress login route and exposes verified aliases for common WordPress paths without editing server configuration automatically. Hide WP Surface reduces common WordPress fingerprints and automated requests: Replaces wp-login.php with a configurable login path. Exposes independently selectable verified aliases for wp-admin, wp-content, and wp-includes. Sends original server paths to the active theme's 404 template only after loopback verification succeeds. Sends nonessential readme, license, and sample configuration disclosure files to the theme 404 while aliases are active. Rewrites WordPress-generated core, plugin, theme, media, responsive image, and redirect URLs. Removes optional generator, discovery, pingback, and core version hints. Uses generic login errors to reduce account enumeration feedback. Provides an emergency recovery constant and recovery file. Path hiding is not an authentication or authorization boundary. Keep WordPress, plugins, and themes updated and use strong passwords, MFA, rate limiting, backups, and a WAF where appropriate. WordPress 7.0 or later. PHP 8.3 or later. HTTPS. Apache 2.4 with modrewrite and .htaccess overrides, or a se