Remove the Generator Meta Tag in Joomla

Every Joomla page tells visitors which CMS built it. Open the page source and you'll find this line in the <head>:

<meta name="generator" content="Joomla! - Open Source Content Management">

Tools that detect a site's CMS read this tag first, and so do automated scanners hunting for Joomla sites. Your RSS and Atom feeds carry the same line. You can remove it everywhere with one PHP snippet in Code Snippets, or replace it with your own text.

The PHP snippet code

Set Code Type to PHP, then use this snippet. It removes the generator meta tag from your pages and the generator element from your RSS and Atom feeds. To show your own text instead, enter it in $generator, for example 'Built by Acme'.

use Joomla\CMS\Factory;

// Leave empty to remove the generator tag, or enter text to replace it.
$generator = '';

// Do not edit below.

$app = Factory::getApplication();

// HTML pages, including error pages: remove or replace the meta tag.
$app->registerEvent('onBeforeCompileHead', function () use ($app, $generator)
{
    $app->getDocument()->setGenerator($generator);
});

// RSS and Atom feeds: remove or replace the generator element.
$app->registerEvent('onAfterRender', function () use ($app, $generator)
{
    if ($app->getDocument()->getType() !== 'feed')
    {
        return;
    }

    $replacement = '';

    if ($generator !== '')
    {
        $replacement = '<generator>' . htmlspecialchars($generator, ENT_XML1, 'UTF-8') . '</generator>';
    }

    $app->setBody(preg_replace('#<generator\b[^>]*>.*?</generator>#s', $replacement, $app->getBody()));
});

Joomla builds the page after PHP snippets run, so the snippet waits for the right moment. It clears the generator just before Joomla writes the page's <head>, and Joomla skips an empty generator on its own. Feeds get the same treatment just before they're sent.

How to add this snippet

1. Install Code Snippets if it isn't installed already.
2. Log into your Joomla backend.
3. Go to Components → Tassos Code Snippets.
4. Click New.
5. Enter a title, for example Remove generator tag.
6. Set Code Type to PHP.
7. Set Insertion Method to Auto-Insert Locations.
8. Set Location to On Page Load.
9. Paste the code above into the editor.
10. Click Save & Close.

Leave the Conditional Logic tab empty so the snippet runs on every page.

Check that it works

1. Open any page of your site.
2. View the page source.
3. Search for generator. It should no longer appear.

If you use Joomla's page caching, cached pages still show the old tag. Clear the cache in System → Clear Cache and check again.

Hide your Joomla version too

Joomla can also add your exact version number to the tag and to your Atom feed. Check that it's turned off:

1. Log into your Joomla backend.
2. Go to System → Global Configuration.
3. Find Joomla Version under Metadata.
4. Set it to Hide.
5. Click Save & Close.

Removing the tag is a small hardening step. Joomla leaves other traces, so a determined visitor can still work out what runs your site, but the tag no longer advertises it.

To learn more about how PHP snippets work, read the PHP snippet docs.