2026-03-20
WordPress still powers over 40% of all websites on the internet, but knowing how to tell if a website uses WordPress isn't always obvious — especially when site owners use custom themes, caching plugins, and other tools that mask the default WordPress footprint. This guide covers six reliable methods that work in 2026.
There are plenty of legitimate reasons to identify a WordPress site:
The fastest way to tell if a website uses WordPress is to scan it at AIWebsiteDetector.com. Paste the URL and the scanner checks dozens of WordPress-specific signals including:
/wp-content/ paths in HTMLThe result comes back in seconds and typically tells you not just that it's WordPress, but which major plugins and themes are detected.
The most famous WordPress fingerprint is the admin login URL. Try appending these paths to any domain:
https://example.com/wp-adminhttps://example.com/wp-login.phpIf a WordPress login page loads (or you're redirected to one), the site runs WordPress. Note that some security plugins redirect or block these URLs for non-authenticated users — but even a 403 Forbidden response at these paths is a strong WordPress indicator.
Press Ctrl+U (or Cmd+U on Mac) to view the page source. Then search (Ctrl+F) for:
wp-content — WordPress stores themes and plugins herewp-includes — Core WordPress scripts and styleswp-json — The WordPress REST API base pathwordpress — Often appears in generator meta tagsThe wp-content path is the most reliable because virtually every WordPress site loads CSS and JavaScript from this directory. A typical WordPress source contains lines like:
In the page source, search for:
This tag appears on most WordPress sites by default. It even tells you the exact version number, which is valuable for security research. Many security-conscious WordPress admins remove this tag using plugins like Yoast SEO or custom functions.php code — but many sites leave it in place.
WordPress automatically generates an RSS feed. Try:
https://example.com/feed/https://example.com/?feed=rss2If a valid RSS/XML feed loads with
Open DevTools (F12) → Application → Cookies. WordPress sets cookies with names like:
wordpress_logged_in_[hash]wp-settings-1wordpress_test_cookieThese only appear if you're logged in or if a login attempt was made, so this method is limited to sites where you have access. It's most useful for auditing sites you manage.
| Method | No Login Needed | Works on Hardened Sites | Speed |
Even then, the RSS feed and REST API (/wp-json/wp/v2/) often remain accessible and reveal the WordPress identity.
Note that WordPress.org (self-hosted) and WordPress.com (hosted service) are different. WordPress.com sites have URLs like example.wordpress.com or use a custom domain but serve content from Automattic's infrastructure. The detection methods above work for both, though self-hosted WordPress is far more common.
Once you confirm a site uses WordPress, you can often learn more:
/wp-content/themes/ paths in the source/wp-content/plugins/ paths reveal installed plugins/readme.html) may reveal itTools like WPScan are purpose-built for WordPress technology enumeration and are commonly used in security audits.
Often yes. The page source typically contains the theme name in the /wp-content/themes/[theme-name]/ path. Browser extensions like Wappalyzer also identify common themes.
Some security plugins redirect unauthorized /wp-admin access to the homepage or a 404 page. This is itself a WordPress indicator — non-WordPress sites simply return a 404 natively. Check other signals like the RSS feed or wp-content paths.
Yes. WordPress maintains roughly 40-43% global CMS market share as of 2026. Despite competition from Webflow, Framer, and AI builders, its plugin ecosystem and content management capabilities keep it dominant for blogs, news sites, and complex content operations.
View the page source and look for /wp-content/plugins/[plugin-name]/. Common plugins leave distinctive CSS class names or script handles. AIWebsiteDetector.com automatically identifies many popular plugins.
Yes. Elementor is a page builder plugin that runs on top of WordPress. If a site uses Elementor, it's a WordPress site. You can identify Elementor specifically by looking for the class elementor-section or scripts from /wp-content/plugins/elementor/.
Now that you can identify WordPress sites, you might want to explore:
WordPress detection is just the beginning. The real value comes from understanding what themes, plugins, and configurations power the sites you admire — and using that knowledge to inform your own builds.