Is it WordPress? Five signs a website runs WordPress, and how to confirm it

Is it WordPress? Open the page source (Ctrl+U) and search for wp-content: if file paths such as /wp-content/themes/… or /wp-content/plugins/… appear, the site almost certainly runs WordPress. A generator meta tag naming WordPress, /wp-includes/ paths and a link to the /wp-json/ API confirm it. Two or three of these signs together are proof; a site that shows none may still be WordPress with its traces removed, or served headless.

This guide is for anyone checking a competitor, vetting a site before taking it on as a client or buying it, or simply curious. You will know the five signs, how to read them in a minute from any desktop browser, and what to make of a site that hides them. WordPress is one of many platforms; the guide to CMSs and how to tell which one a site uses covers the others.

Quick answer

• Sign 1: /wp-content/ in the page source (themes, plugins, uploads).
• Sign 2: /wp-includes/ paths, WordPress's own core scripts and styles.
• Sign 3: <meta name="generator" content="WordPress 6.x"> in the page head.
• Sign 4: a link to the REST API: rel="https://api.w.org/" pointing to /wp-json/, in the HTML or a Link header.
• Sign 5: WordPress markup such as wp-block- classes or the wp-emoji script.
• Or let a tool read them: the free CMS detector names WordPress and shows which sign it matched.

Sign 1: /wp-content/ in the page source

WordPress keeps everything a site adds on top of the core in one folder: themes in /wp-content/themes/, plugins in /wp-content/plugins/ and uploaded media in /wp-content/uploads/. Almost every page loads a stylesheet or script from there, so the path appears in the HTML.

To check, open the page in a desktop browser, press Ctrl+U (Cmd+Option+U on a Mac) to view the source, press Ctrl+F and search for wp-content. Typical hits:

<link rel="stylesheet" href="https://example.com/wp-content/themes/astra/style.min.css?ver=4.8.1">
<script src="https://example.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.0"></script>

This is the strongest single sign, and it also tells you the theme and plugins, which the guide to finding the WordPress theme a site uses explains.

One caution: check that the paths are on the site's own domain or its CDN. An image embedded from another WordPress site brings that site's /wp-content/uploads/ path with it.

Sign 2: /wp-includes/ paths

/wp-includes/ holds WordPress's own code, and many pages load core scripts from it, such as /wp-includes/js/jquery/jquery.min.js or the block library styles at /wp-includes/css/dist/block-library/style.min.css. Search the source for wp-includes. Together with sign 1, it rules out a lone hotlinked image.

Sign 3: the generator meta tag

By default WordPress prints its name and version in the page head:

<meta name="generator" content="WordPress 6.8.2">

Search the source for generator. Many sites remove the tag, often through a security or SEO plugin, so its absence proves nothing. Where it is present, it also gives the version, which is the subject of the guide to reading the generator tag and updating WordPress safely.

WordPress also puts a generator line in its RSS feed, <generator>https://wordpress.org/?v=6.8.2</generator>, which some sites forget to remove. If the page links to a feed in its head, that feed is a public page like any other.

Sign 4: a link to the WordPress REST API

Every WordPress site since version 4.7 has a REST API at /wp-json/, and advertises it by default with a link in the page head:

<link rel="https://api.w.org/" href="https://example.com/wp-json/">

The same link is often sent as a Link response header, which you can see in the developer tools (F12 → Network, click the page, Response Headers). The api.w.org relation is specific to WordPress, which makes it a clean sign.

Sign 5: WordPress markup

Smaller traces add up when the paths are hidden:

• wp-block- classes, such as wp-block-group or wp-block-image, come from the block editor.
• The wp-emoji script, wp-emoji-release.min.js, loaded unless a plugin or theme removes it.
• Plugin fingerprints, such as an HTML comment from Yoast SEO or a caching plugin.
• wp-json or admin-ajax.php URLs inside inline scripts.

Check it with a tool

The CMS detector loads the page in a real browser and checks all of the signs above, then names WordPress with the evidence it matched, such as the generator tag or the /wp-content/ path, so you can confirm it yourself. It also names page builders such as Elementor and Divi, common plugins, JavaScript libraries, the CDN and the server.

For a WordPress site, two tools go further:

• The WordPress security scan and health check recognises WordPress from the same signs, then looks for classic launch mistakes, an outdated core and closed plugins.
• The WordPress theme and plugin detector lists the theme, the page builder and every plugin the page loads, with what each costs in kilobytes.

Confirm without probing

Everything above reads what the site sends to every visitor. You do not need to go further to answer the question, and on a site you do not own you should not. Visiting /wp-admin/ or /wp-login.php, guessing plugin folders or requesting files such as readme.html all show up in the owner's security logs as the kind of requests attack tools make, and some security plugins block your address for it.

getReport follows the same rule: detection is passive, from the page itself, and the WordPress health check requests at most a short fixed list of well-known public addresses.

Why a WordPress site can look like it is not

• Traces removed. Security and "hide WordPress" plugins strip the generator tag, remove the API link and emoji script, and some rewrite /wp-content/ to another name. A thorough job hides it from quick checks.
• Headless WordPress. WordPress stores the content, and a separate front end built with a framework such as Next.js or Astro renders the pages. The visible site shows the framework; WordPress may only surface in image URLs pointing to /wp-content/uploads/ on another domain.
• A static export. Some sites are built in WordPress and exported to plain HTML files. The paths may remain, but there is no WordPress running any more.
• A page from another system. A shop on Shopify can have a blog on WordPress, or the reverse. Check the page you care about, not only the home page.

WordPress.com or self-hosted?

The same software runs on two kinds of service. WordPress.org software is installed on hosting you choose; WordPress.com is a hosted service by Automattic. Hints for WordPress.com: an address ending in .wordpress.com, and files loaded from s0.wp.com or s1.wp.com. These hints are not proof, because self-hosted sites running Automattic's Jetpack plugin load some files from wp.com too. Where a site is hosted is a separate question, answered in the guide to finding who hosts a website.

What to do with the answer

Knowing a site runs WordPress tells you where to look next:

• its theme and plugins, from the /wp-content/ paths;
• its version, from the generator tag, and whether it is out of date;
• its host, from the IP address and headers.

For your own site, the WordPress security basics guide covers what visitors and scanners can see and how to reduce it.

Common mistakes

• Relying on one sign. A single /wp-content/ image can be hotlinked from elsewhere. Look for two or three that agree.
• Reading a missing generator tag as "not WordPress". Many WordPress sites remove it.
• Probing admin paths on someone else's site. It is not needed and it looks like an attack.
• Checking only the home page. A landing page builder or a separate shop can sit on a different system.

Questions people ask

Can a WordPress site hide that it runs WordPress?

Mostly, yes. Plugins can remove the generator tag, the REST API link and the emoji script, and some rename the /wp-content/ folder in URLs. Hiding it this thoroughly is rare, and it does not make a site safer on its own: attack tools try WordPress exploits whether or not the site admits to running it. Keeping WordPress updated matters far more.

How can I tell WordPress.com from self-hosted WordPress?

Look for an address ending in .wordpress.com and files loaded from s0.wp.com or s1.wp.com, which suggest WordPress.com. Self-hosted sites load everything from their own domain or CDN, although the Jetpack plugin also loads some files from wp.com. For a custom domain, the IP address and headers show whether Automattic or another host serves the site.

Does a /wp-admin/ page prove a site is WordPress?

On your own site, yes, but it is not a good test for someone else's. Requesting admin paths on a site you do not own looks like an attack in the owner's logs and may get your address blocked. The page source already answers the question: /wp-content/ paths and the api.w.org link are clear signs, and they are what every visitor receives anyway.

Why does a detector say a WordPress site is not WordPress?

Because the page it checked revealed no sign of it. The site may remove the generator tag and rewrite /wp-content/ paths, render its pages with a headless front end, or serve a page built with another system. Some detectors also read only the raw HTML and miss what scripts add. Check another page and look at the evidence the detector shows.