Free tool · no signup
Is this site WordPress — and is it healthy?
Paste any address to find out whether it runs WordPress, which version it publishes, who hosts it, and which security headers it sends. We load the homepage once, read what it already tells every visitor, and show you the result. Free, no signup, nothing installed.
No signup. We load the homepage once — the same single request any visitor makes — and report what it tells us. Nothing else on the site is touched.
How you can tell a site is WordPress
WordPress leaves five fingerprints on a page it serves, and this checker reads all of them from a single request:
- The generator tag — a line in the page source naming WordPress and often the exact version.
- /wp-content/ — themes, plugins and uploads load from this folder.
- /wp-includes/ — core scripts load from here.
- The X-Pingback header — announces XML-RPC, which WordPress enables by default.
- The REST API link — a Link header pointing at api.w.org.
A well-hardened site can hide every one of them, so an empty result is evidence rather than proof. It is also, usually, a sign of a site that has been set up carefully.
What this cannot tell you
It cannot tell you why an update broke your site. A single page request reveals nothing about your plugins, your theme files, your database or your users, and that is where a broken update actually lives. It cannot tell you whether a site has been compromised either — no external checker can, which is exactly why the tools that genuinely detect that run installed on the site.
What it does do is read, honestly, what your server volunteers to every visitor. If you want to know what a real visitor experiences — the link that 404s, the contact form that submits and never arrives, the button pushed off the screen on a phone — that needs a browser to actually use the site, which is what the free scan does.
Common questions
How do I check if a website is built with WordPress?
Paste the address into the checker above. We load the homepage once and look for five things WordPress publishes about itself: the generator meta tag, files loaded from /wp-content/ and /wp-includes/, an X-Pingback header, and the WordPress REST API advertised in the Link header. Any one of those is strong evidence; none of them means it is probably not WordPress, though a heavily customised or fully cached site can hide all five.
How do I find out what WordPress version a site is running?
WordPress publishes its version in a generator meta tag, and the checker reads it when present. Most sites do not publish it — security plugins strip that tag precisely because announcing your version tells attackers which exploits to try. If the version comes back blank, that is a sign the site is configured sensibly, not a failure of the check. On your own site you can always see it under Tools, Site Health, Info, WordPress.
Can you tell me why my WordPress site broke after an update?
Not from outside, and nobody else can either. A broken update usually involves a plugin conflict, a theme file or a PHP error, and none of that is visible from a single page request. What a scan can show you is the result: a form that submits but never arrives, a button pushed off screen on a phone, a page returning an error, a layout that collapsed. If you want the cause rather than the symptom, you need access to the site itself.
Is this a WordPress security scanner?
No. It reads what your server publishes to every visitor — whether WordPress is in use, the version if announced, your hosting platform, whether XML-RPC is advertised, and which common security headers you send. It does not test for vulnerabilities, scan for malware, or check your plugins, and it cannot tell you whether a site has been broken into. Tools that genuinely detect a compromise run installed on the site, which is why Wordfence and Patchstack work that way.
Does checking someone else’s site cause them any problem?
No. It makes exactly one request to the address you type — the same single page load any visitor makes — and reads the response. It does not request hidden paths, submit forms, try passwords or attempt to get around a firewall. If a site blocks the request we report that it blocked us and stop there.
What does the full scan check that this page does not?
The free scan opens your site in a real browser and uses it the way a visitor would: it follows your links to find the broken ones, submits forms to see whether they actually work, renders the page at phone width to catch buttons pushed off screen, runs accessibility checks and captures console errors. This page reads one response; the scan interacts with the site.
Last reviewed . Written and maintained by Waqas Ahmad, a QA engineer with nine years’ experience.