The fastest way to check: paste the domain into AI Website Detector’s WordPress checker, which scans the page for CMS markers, REST API endpoints, theme and plugin paths, and hosting fingerprints in a few seconds — no signup required. For a manual confirmation, or when a site has deliberately hidden its CMS, view-source and a couple of URL checks close the gap.

WordPress still powers a large majority of the identifiable web — by some counts over 40% of all websites and roughly 60% of sites running a known CMS, according to W3Techs. That scale is exactly why detecting it matters: for competitive research, vetting a freelancer’s “custom build” claim, migration scoping, or a basic security check before you trust a site with sensitive data.

This guide covers the automated scan, the manual fingerprints that work even when a scanner comes up empty, and what to do when a site has actively hidden that it’s running WordPress.

Table of Contents

Why Check If a Website Uses WordPress?

  • Vetting a freelancer or agency. Confirm whether a “hand-coded” site is actually a WordPress theme with heavy customization — relevant before you pay a custom-build invoice.
  • Competitive and market research. See what percentage of a niche or industry runs on WordPress versus Shopify, Webflow, or a headless stack.
  • Security due diligence. An outdated WordPress core, an abandoned plugin, or a known-vulnerable theme is one of the most common attack surfaces on the web — worth checking before integrating with or acquiring a site.
  • Migration planning. If you’re moving a site off WordPress (or onto it), knowing the current theme and plugin stack shapes the scope of the project before you quote it.
  • Plugin and theme sales targeting. If you sell WordPress plugins or themes, confirming a prospect already runs WordPress is the first qualifying signal in any outreach.

Method 1: Use an Automated WordPress Scanner

An automated scan covers the vast majority of cases in a few seconds, without opening a single dev tool.

  • Open the checker. Go to AI Website Detector’s WordPress detector and paste the full domain, including https://.
  • Run the scan. It checks for WordPress-specific file paths, the REST API endpoint, meta generator tags, script handles, and known plugin/theme signatures, then returns a confidence-scored verdict.
  • Get the full stack, not just a yes/no. Beyond CMS confirmation, the tech stack detector also surfaces hosting, CDN, and analytics tools running alongside WordPress — useful if you’re scoping more than just “is this WordPress.”
  • Rule out AI involvement if relevant. A growing number of AI website builders (10Web, Hostinger AI) generate sites on top of WordPress. If that distinction matters, run the domain through the AI probability scanner as well.

Pro tip: Save the scan result URL. It’s timestamped and carries the full artifact list, which works as a citable record for an audit report or client email without any reformatting.

Other WordPress Lookup Tools

General-purpose tech profilers can also confirm WordPress, though none specialize in the CMS the way a dedicated checker does:

  • BuiltWith — strong historical data on when WordPress (and specific plugins) were first detected on a domain.
  • Wappalyzer — fast categorized detection, including some theme and page-builder identification.
  • W3Techs — useful for server and hosting-level detail alongside CMS confirmation.
Tool WordPress-specific Plugin/theme detection Confidence scoring Free, no signup
AI Website Detector Yes (dedicated) Yes Yes, with rationale Yes
BuiltWith General CMS Partial Partial Limited free lookups
Wappalyzer General CMS Yes Yes Generous free tier
W3Techs General CMS No N/A Yes
Browser DevTools Manual Manual Manual judgment Yes, built in

Method 2: Use a Browser Extension

For repeated lookups while browsing, an extension is faster than pasting URLs into a scanner each time:

  • Wappalyzer extension (Chrome, Firefox, Edge) — flags WordPress plus the active theme and detected plugins in a toolbar dropdown.
  • WhatRuns (Chrome) — one-click detection, with an option to get alerted if a followed site’s stack changes.

Method 3: Manual Page Source Inspection

Manual checks work even against sites a scanner flags as low-confidence, and they take under a minute once you know what to search for.

Search the page source

Right-click the page and choose View Page Source (Ctrl+U / Cmd+Option+U), then Ctrl+F for:

  • Asset paths: /wp-content/ and /wp-includes/ — the single most reliable WordPress signal, present on almost every default install.
  • Generator meta tag: <meta name="generator" content="WordPress 7.0.2"> — present unless a security plugin has stripped it.
  • Emoji script: wp-emoji-release.min.js — loaded by WordPress core on most themes unless disabled.
  • Block editor CSS: wp-block-library-css — indicates the Gutenberg block editor is active.
<!-- Telltale sign of a WordPress CMS site -->
<link rel='stylesheet' id='wp-block-library-css'
  href='https://example.com/wp-includes/css/dist/block-library/style.min.css' />
<meta name="generator" content="WordPress 7.0.2" />

Check the REST API endpoint directly

WordPress ships a REST API by default. Visit the following path on the target domain:

https://example.com/wp-json/wp/v2/

A JSON response listing routes like posts, pages, and media confirms WordPress even when the front end shows no visible CMS markup at all — this is the single most reliable check against headless or heavily customized WordPress builds.

Check other default WordPress paths

  • /wp-login.php — the default login screen, present unless renamed by a security plugin.
  • /wp-admin/ — typically redirects to the login screen rather than returning a 404 on active installs.
  • /xmlrpc.php — returns an XML-RPC error message rather than a 404 if the legacy API is still enabled.
  • /feed/ — WordPress auto-generates an RSS feed at this path by default.

Check response headers

Some hosts leave a header disclosure even when the HTML has been scrubbed:

curl -I https://example.com

Look for link: <https://example.com/wp-json/>; rel="https://api.w.org/" in the response headers — WordPress adds this by default, and it’s one of the harder signals to remove without editing core files.

Pro tip: The wp-json header link and the REST API response are the two hardest WordPress signals to hide, because removing them breaks core functionality (the block editor and most page builders depend on the REST API). Check these two first if a site looks scrubbed.

WordPress Fingerprint Cheat Sheet

Signal What to check Reliability
Asset paths /wp-content/, /wp-includes/ in view-source High
REST API /wp-json/wp/v2/ returns JSON Very high
REST API header link: rel="https://api.w.org/" in response headers Very high
Generator meta tag <meta name="generator" content="WordPress...") Medium (often removed)
Login page /wp-login.php loads a WP login form High
XML-RPC /xmlrpc.php returns an XML-RPC error Medium
RSS feed /feed/ returns a WordPress-formatted feed Medium

Detecting the Theme and Plugins, Not Just the CMS

Confirming WordPress is usually step one — the theme and plugin stack is often what you actually need for a migration quote, a competitive teardown, or a security review.

  • Theme path: search view-source for /wp-content/themes/ — the folder name immediately after it is the active theme’s slug (e.g., /wp-content/themes/astra/).
  • Plugin paths: search for /wp-content/plugins/ — each enqueued script or stylesheet reveals an active plugin slug.
  • Page builders leave heavy signatures: Elementor adds elementor- prefixed classes throughout the markup; Divi adds et_pb_ classes; WPBakery adds vc_row/vc_column classes. These are hard to miss once you know to look.
  • WooCommerce: look for woocommerce classes on product and cart pages, plus a /wp-json/wc/v3/ REST namespace on stores with the API enabled.
  • Caching and security plugins: response headers like x-cache: HIT or comments in the HTML (<!-- This page was cached by WP Super Cache -->) reveal specific performance plugins.

A dedicated scan surfaces most of this automatically — the WordPress detector reports the detected theme and plugin signatures alongside the CMS confirmation, which is faster than searching view-source by hand for each one.

When WordPress Is Hidden or Headless

Security plugins strip visible markers. Plugins like Wordfence or iThemes Security routinely remove the generator tag, rename /wp-login.php, and block direct access to /wp-content/ listings. None of this touches the REST API or the wp-json header link, which is why those two checks matter more than the generator tag.

Headless WordPress separates the CMS from the front end. A Next.js or Gatsby front end pulling content from WordPress via the REST API or WPGraphQL can render pages with zero visible WordPress markup. The giveaway is the API layer itself — query /wp-json/wp/v2/posts directly, or check for a /graphql endpoint if WPGraphQL is in use.

CDNs can mask hosting-level clues. Cloudflare or a similar CDN in front of a WordPress site will show CDN headers rather than the origin server’s headers — this affects hosting detection more than CMS detection, since the REST API and asset paths pass through unchanged.

When none of these checks resolve cleanly, note what you found and what you couldn’t confirm rather than forcing a verdict — a documented “likely WordPress, REST API returns 403, asset paths blocked” is more useful than a confident guess.

Method 4: Hosting and DNS Clues

Managed WordPress hosts often leave their own fingerprints independent of the CMS itself, which is useful when you also need to know where a site is hosted, not just what it runs.

  • WP Engine — response headers often include x-powered-by: WP Engine.
  • Kinsta — typically fronted by their own CDN, visible in server or x-kinsta-cache headers.
  • SiteGround / Bluehost — less distinctive at the header level; nameserver lookups (dig example.com NS +short) are more reliable here.

Pair a DNS lookup with the hosting lookup tool to confirm the hosting provider and CDN in one step, rather than parsing raw header and nameserver output by hand.

A 5-Step Verification Workflow

  1. Run the automated scan. Start with the WordPress detector for an instant, confidence-scored baseline.
  2. Confirm with the REST API. Visit /wp-json/wp/v2/ directly — this alone resolves most “is it hidden or is it not WordPress” ambiguity.
  3. Identify the theme and plugins. Search view-source for /wp-content/themes/ and /wp-content/plugins/, or read them straight off the scan output.
  4. Check hosting separately if relevant. Use a DNS lookup or the hosting tool if you need the hosting provider for a migration or performance assessment.
  5. Document the result. Scan URL, REST API response, and any theme/plugin slugs found — enough for the finding to hold up in a report or client email.

Key Takeaways

  • Point
  • Details
  • Start with an automated scan
  • A dedicated WordPress checker confirms the CMS plus theme and plugin signatures in seconds.
  • The REST API is the hardest signal to hide
  • /wp-json/wp/v2/ and the api.w.org header link survive most obfuscation attempts because core functionality depends on them.
  • Generator tags are the weakest signal
  • Security plugins routinely strip them — don’t rely on the meta tag alone.
  • Theme and plugin paths matter for scoping
  • /wp-content/themes/ and /wp-content/plugins/ reveal exactly what a migration or rebuild needs to account for.
  • Headless WordPress needs the API check
  • A Next.js or Gatsby front end can hide every visible WordPress marker except the REST API layer.

Frequently Asked Questions

What is the fastest way to check if a site uses WordPress?

Paste the domain into a WordPress checker for an instant, no-signup scan. It confirms the CMS and reports the detected theme and plugins in one pass.

Can a website hide that it’s built with WordPress?

Partially. Security plugins can remove the generator meta tag and rename /wp-login.php, but the REST API at /wp-json/wp/v2/ and the corresponding response header are much harder to remove without breaking the block editor and most plugins.

How do I check the WordPress version of a site?

The generator meta tag in view-source often states the version directly (e.g., WordPress 7.0.2). If that’s been stripped, some version-specific static asset filenames (like a bundled script’s query-string version parameter) can approximate it, though this is less reliable.

How do I find out which theme or plugins a WordPress site uses?

Search view-source for /wp-content/themes/ (the folder name is the theme slug) and /wp-content/plugins/ (each enqueued asset reveals an active plugin). A dedicated scan reports both automatically.

Can WordPress be used headlessly, with no visible front-end markup?

Yes. A Next.js, Gatsby, or other JavaScript front end can pull content from WordPress via the REST API or WPGraphQL while showing zero classic WordPress markup. Query /wp-json/wp/v2/posts or check for a /graphql endpoint to confirm in that case.

Is checking a site’s CMS legal?

Yes. Viewing page source, response headers, and public REST API endpoints is public data your browser already downloads to render the page. Attempting to exploit anything found this way, without permission, is a separate matter.

Related Tools

Recommended

Conclusion

Checking whether a site runs WordPress is usually a one-step scan — but the REST API endpoint, not the generator tag, is what actually holds up when a site has tried to hide it. Combine an automated scan with a direct look at /wp-json/wp/v2/ and you’ll have a confirmed, defensible answer in under a minute, plugin and theme details included.

Ready to check a site? Run a free WordPress detection scan — no account required.