Do you often see a great looking site and ask yourself “does it use WordPress?” Sometimes the answer is simple – footer says it all, but more often than not you have to do a bit of detective work. With more and more webmasters hiding the fact they use WordPress we’ll teach you different ways to confirm if a site uses WordPress or not, discuss why some feel the need to hide the fact they use WP and show you a neat trick to find out what theme a site uses.
What’s With The Hiding?
We’re sure that in one context or another you’ve heard about people hiding the fact their site uses WordPress and how that’s a good or a bad thing. So let us clarify a few things.
You should never be ashamed of using WordPress! In fact, you should proudly tell everyone your site is powered by one of the best pieces of open source software ever created. Hiding the exact version of WP you’re using is a whole different game. Due to ever growing risk of being hacked that is a wise thing to do as exposing the exact version number can expose you to greater risks of being hacked.
Most “Hackers” Are Lazy
When bad people try to take down as many sites as possible in the shortest period, they utilize a principle called the “low-hanging fruit.” It’s just a fancy way of saying “hack the most vulnerable sites first.” They either find a new WP vulnerability or choose an older one that’s already patched in the newer versions but exists on many sites because people don’t update WP often enough. By using Google, they get a list of thousands of sites using those specific versions and then perform an automated attack that takes all of those sites down using the same vulnerability.
Your site might still be using that specific (problematic) version of WordPress, but if you make just a tiny effort to hide the version it uses, it’ll mean you won’t be hit in that first wave as you are not a “low hanging fruit.” That won’t help you if someone is targeting your site specifically but it will with these automated attacks.
With that out of the way lets look at some of the methods you can use to find out if a site is powered by WordPress or not.
1. There’s A Service For That
As with most things on the Internet if you need some service that automates a simple task chances are it already exists. If messing with code is not your thing head over to WP Loop’s Is it WordPress tool enter the sites URL, and it tells you if it uses WordPress. If you’re not satisfied with the results or want more technical info BuiltWith can help you. Again, just type in the site’s URL and click search. You can also utilize specialized services like What WP Theme is That? to find the theme powering a site. But please bear in mind that all those sites use the methods described below. There’s no magic to them.
2. Starting Off Easy – Just Read
Many sites are, as we’ve already said, proud to use WordPress so if you just scroll down to the footer, you’ll probably see a “Powered by WordPress” line. If you happen to be on a blogger’s site chances are you can find out a lot more by visiting the about, how it was made, technology stack or some similar page where an up to date list of all plugins and tools used to create the site is shown.
3. Digging Into The Source – The Dreaded Generator Tag
For this method and a few following, we’ll need the HTML source of the site’s home page. Actually, any page’s source will do, but let’s stick with the home page. Right-click somewhere on the page (that’s not an image or a link) and choose “View Page Source.” If you’re on Chrome, Ctrl+U will also do the trick.
Now that you have the HTML hit Ctrl+F to bring out the search field and type in “generator.” You’re looking for a line that looks like this:
<meta name="generator" content="WordPress 4.6.1" />
No such line? Read on; there are plenty other methods to confirm if a sire is on WP or not.
Did you found it, but it doesn’t look like that? That’s possible too. One often seen variation is just “WordPress” – that means the webmaster doesn’t want to disclose the exact WP version (which is, as we’ve already discussed a good think). Another possibility is that the site isn’t powered by WP so the generator can be something else, like Joomla.
4. Still In The Source – Some Often Used Paths
You should still have the source open along with the search field. Just change the search string into “wp-content”. Found a bunch of lines with that string? Great – the site is undoubtedly using WordPress.
Want to know what theme they’re using? Search for “wp-content/themes/”, and you’ll probably get a few hits. Now look for the line that ends in “style.css” or “style.css?v=x.y” – that’s the main theme’s CSS file. Click that link to open it or copy/paste it into a new tab. The whole URL will look something like “http://domain.com/wp-content/themes/twentysixteen/style.css?ver=4.6.1”. First ten-ish lines of that file will give you enough data to find the theme on the web.
No luck with this method? It seems somebody doesn’t want us to know they’re using WP. No worries. Let’s continue with our detective work.
5. WP Specific URLs
readme.html file in the site’s root, i.e., “http://domain.com/readme.html.” If it worked, you’ll get something similar to this. No luck? Then try http://domain.com/license.txt it should look like this sample file. Still no luck? Give http://domain.com/wp-admin/ a go and the WP login screen should pop up.
If none of the methods above worked then somebody invested a lot of work into hiding the fact they use WordPress or, as said as that is, they are just not using WordPress. Tell them to switch 😉
Have you tried any of these methods? Or do you have another to add? Tell us in the comments below!