How to tell if a website uses WordPress
WordPress leaves fingerprints that are hard to remove completely. Themes and plugins load their files from /wp-content/, the core scripts come from /wp-includes/, and most sites answer at /wp-json/, the WordPress REST API. Many also print a generator tag with the WordPress version in the page source.
The checker reads the home page like a browser does and looks for each of these signs. The report lists the ones it found, so you can see why the answer is yes. When the HTML has been cleaned up, it asks the REST API directly, which catches most sites that hide their files behind a CDN.
| Sign | What it means |
|---|---|
| Files from /wp-content/ | A WordPress theme or plugin is loading its CSS, JavaScript or images. |
| Files from /wp-includes/ | WordPress core scripts, such as jQuery or the block library, are in use. |
| REST API at /wp-json/ | The site answers the WordPress API. This is the hardest sign to hide. |
| Generator tag | The page says it was made with WordPress, often with the exact version. |
What you get when the answer is yes
The same check also reads the theme, the plugins it can see and the WordPress version, and runs the passive security checks. Use the tabs above the address field to jump to the theme detector, plugin detector, version checker or vulnerability scanner view of the same site.
When the answer is no
If none of the signs show up, the site is very likely built with something else. The report names the platform when it recognises it, for example Shopify, Wix, Squarespace, Webflow, Ghost, Drupal, Joomla or a JavaScript framework such as Next.js. A small number of WordPress sites hide every trace behind a headless setup or a heavy proxy, and those can look like something else from the outside.