- Reading the home page
- HTTP headers and certificate
- Well-known WordPress addresses
- Plugins, theme and versions
- Known vulnerabilities
- Computing the score
WordPress detector: does this site give WordPress away?
Enter an address: the detector spots WordPress, its version, the theme and the plugins, grades the site's discretion and security, and shows what masks each trace.
What the detector checks
It reads the home page the way detection tools or a bot preparing an attack do, then queries a few well-known public WordPress addresses. Each trace found is classified, explained in one line and linked to the feature that removes it.
| What is checked | What it reveals | Who masks it |
|---|---|---|
| Generator tags, HTML comments, RSD, WLW and short links | WordPress, its version, your SEO or cache plugins | Free feature |
| /wp-content/ and /wp-includes/ addresses, plugin and theme folders | The list of your plugins and the name of the theme | Pro feature |
| wp-login.php, /wp-admin/ and eleven other common login addresses | The door brute force bots aim at | Free feature |
| /?author=1, /wp-json/wp/v2/users, author sitemap | Usernames (masked in the report) | Pro feature |
| Versions of WordPress, plugins and theme | Missing updates and known vulnerabilities | Your updates, alerts with Pro |
| Security headers, HTTPS certificate, host | The level of browser and connection protection | Pro feature for the headers |
Reading the result
- Overall score, from A to F: six weighted criteria (WordPress traces, login, accounts, versions and vulnerabilities, security headers, HTTPS). Each criterion has its own grade and a one-line explanation.
- Verdict: "WordPress detected" when the pages show it, "can be spotted" when only well-known addresses still answer, "well masked" when only faint or necessary clues remain.
- Badges: Free feature and Pro feature show which version of WP Masquerade removes the trace; "To do" flags an action on your side (file, theme, server); "Kept" marks what WordPress or your plugins rely on.
- Plugin profiles: the name of a detected plugin opens its profile once published (recommended settings, what WP Masquerade hides). They are all gathered in the list of camouflaged plugins.
Method and limits
An analysis makes about thirty light requests (read only, GET or HEAD): the home page, eight well-known WordPress addresses, thirteen common login addresses, the theme style sheet and at most five plugin readme files. Versions are compared with the latest published releases; vulnerabilities come from a public vulnerability database and are only looked up for versions that are actually visible.
- Only the home page is read: a plugin used on other pages may not show up.
- A cache or CDN may serve a page older than your latest settings: purge it before running the analysis again.
- JavaScript variables are read in the page code, without running the scripts: a variable created only at run time can therefore go unnoticed.
- One site is only analysed a few times per hour; each result is reused for 10 minutes.
Responsible use and privacy
The detector only performs a passive analysis, comparable to common detection tools: it reads public pages and addresses only, sends no credentials, attempts no login and does not look for sensitive files. Use it for your own sites, your clients' sites with their consent, or for information. Private addresses and internal networks are refused.
The result is cached for 10 minutes, then deleted; no full address is stored. A share link is only created when you click "Share": it stays valid for 30 days and can be deleted at any time. Details in the privacy policy.
Frequently asked questions
How can I tell if a site uses WordPress?
Enter its address in the detector. It looks for WordPress signatures in the page code (generator tag, /wp-content/ and /wp-includes/ folders, REST API announcement), then checks typical addresses such as wp-login.php or /wp-json/. The verdict gives the probability and each piece of evidence found.
Why mask WordPress?
Bots that exploit vulnerabilities look for WordPress sites first, then for vulnerable versions and plugins. A site that shows neither its software nor its plugins drops out of many of these lists. Masking complements updates, it does not replace them.
My site is masked by WP Masquerade: why are there traces left?
Some traces are needed for the site to work (REST API, block CSS classes) or are out of reach of a plugin (headers added by the host or the CDN). Others need the Pro version (file addresses, author list) or a cached page to purge. The report says, for each trace, who can remove it.
Does the detector find every installed plugin?
No: it only sees those that leave a trace on the home page (files, generator tag, comments, JavaScript variables). A plugin without a public trace, such as a backup plugin, stays invisible, which is a good thing.
Is this analysis legal?
It only reads what the site sends to any visitor, like a browser or a detection tool, without any login attempt or intrusion. Preferably analyse your own sites, or your clients' sites with their consent.
What does a share link contain?
A snapshot of the report, with no username in clear text and only the number and severity of vulnerabilities. The link is not indexed by search engines, expires after 30 days and can be deleted with the button shown when it is created.