WordPress Detector — is a site built with WordPress?
Check whether a website is built with WordPress (or another CMS / framework) by inspecting its response headers and markup.
How to read the result
- WordPress
- Whether the markup and headers carry WordPress's fingerprints — most reliably the
/wp-content/and/wp-includes/paths its own pages load assets from. - Detected CMS
- What was identified instead, if anything. The same check covers Joomla, Drupal, Shopify, Webflow, Wix, Squarespace and a long tail of others.
- What the check actually looks at
- The asset paths a WordPress page loads its own files from —
/wp-content/and/wp-includes/— plus the generator meta tag and response headers. The paths are the reliable part; the generator tag is the first thing hardening removes. - Other platforms it recognises
- The same pass identifies Joomla, Drupal, Shopify, Webflow, Wix, Squarespace, Ghost, PrestaShop and a number of regional systems, so a negative WordPress answer often still names what the site does run.
Where this tool is wrong
Every check here reads one signal, and each has a blind spot worth knowing before you act on the answer.
- A negative result is weak. Security and performance plugins remove the generator tag and rewrite asset paths specifically to make this check fail, and they succeed.
- A headless WordPress serves its front end from a separate application with no WordPress markers in it at all. The CMS is there; nothing about the page says so.
- A positive result, by contrast, is strong — the asset paths that trigger it are hard to produce by accident.
- Detection reads the homepage only. A site can run WordPress on a blog subdirectory while serving something else at the root, and that will not show here.
Common questions
It says my site is not WordPress, but it is. Why?
Something is hiding the markers, which is usually deliberate. A security plugin, a caching layer rewriting asset URLs, or a headless setup will each produce this. It is a sign the site is maintained rather than a fault.
Can this tell me which WordPress version a site runs?
Not this tool — it answers yes or no. The CMS version checker reads the version, along with the active theme and the plugins the page loads.
Is it bad that my site announces it runs WordPress?
By itself, no. A quarter of the web runs WordPress and attackers scan indiscriminately rather than picking targets from a list. What matters is whether the core and plugins are updated.
Why would anyone hide that they use WordPress?
To slow down automated scanning. Bots sweep for known plugin vulnerabilities and a site that does not advertise its platform gets fewer of those probes. It buys noise reduction, not safety — an updated site is the actual defence.