# WordPress Version Checker

> Check which WordPress version a site runs and whether it is current, behind, or marked as insecure by WordPress.org.

- Source: https://plugstack.dev/tools/wordpress-version-checker/
- Published by: PlugStack
- Last updated: 2026-10-22

## Where the version comes from

 

WordPress writes its version into several places a visitor can see: the generator tag in the page head, the version numbers on core files such as the block library stylesheet, and the RSS feed. The checker reads them in that order and tells you which one it used.

 

## Latest, behind or insecure

 

The version is compared with live data from WordPress.org, which keeps a list of every release and marks each one as the latest, an older release, or insecure. Insecure means the version has security problems that a newer release fixes.

 
 

| Result | What to do |
| --- | --- |
| Latest release | Nothing. Keep automatic minor updates on. |
| Update available | Plan the update. Older branches get security fixes for a while, but not forever. |
| Insecure version | Update now. Back up first, and test on a staging copy if the site is busy. |
| Hidden | The site does not show its version. That is good practice, as long as updates still happen. |

 
 

## Should you hide your WordPress version?

 

Hiding the version stops lazy scanners from picking you out, but it is not protection. Bots try known attacks on every WordPress site anyway. Running the latest version matters far more than hiding it, which is why the report counts an outdated version as a real problem and a visible version only as a small one.

 

The same report checks the plugins too, which are a more common way in than WordPress itself. See them first in the [WordPress plugin detector](https://plugstack.dev/tools/wordpress-plugin-detector/), or run the full [WordPress vulnerability scanner](https://plugstack.dev/tools/wordpress-vulnerability-scanner/).

## FAQ
### Is checking a site's WordPress version legal?
Yes. The checker only reads what any browser receives when it opens the home page, plus the public RSS feed.

### Why does it say "hidden"?
The site removed the generator tag and the version numbers from its core files. That is a common hardening step, so the version cannot be compared from outside.

### How often is the latest version updated?
The list of releases comes from WordPress.org and is refreshed every few hours, so a new release shows up the same day.

### Does an old version mean the site is hacked?
No. It means the site is missing fixes. An insecure version is a real risk, but it says nothing about whether anyone used it.

### Do you save the sites I check?
Each report is saved for 30 days so the share link keeps working, then deleted. Your IP address is not stored with it. Nothing about you is sent to the site you check.