WordPress

WordPress and WordPress.com are not the same thing

This distinction causes more confusion than any other question about the platform, and it matters for detection, because the two leave different traces. They are not competing products so much as two different ways of getting to the same software.

WordPress, the software

This is the open source project, distributed from WordPress.org. It is free, you install it on hosting you control, and you can do anything with it: any theme, any plugin, any code change, any server. Nobody can restrict what you install or remove your site. This is what people mean by WordPress when they talk about it as a CMS, and it is what this page is about. When someone says a site is built on WordPress, they almost always mean this.

WordPress.com, the hosted service

This is a commercial hosting product built on top of that software and run by a company. You sign up rather than install, and the hosting, updates and security are handled for you. The trade-off is control: what you can install depends on which plan you are on, and the lower plans restrict themes and plugins in ways that self-hosted WordPress never does. It is a convenient front door to the software, but it is a service rather than the software itself.

Telling the two apart from the outside

Usefully, they are easy to distinguish, and the giveaway is where the site loads its files from. A self-hosted site serves its theme and plugin files from its own domain. A site on the hosted service pulls much of its assets from the service's own content network instead, and its pages tend to carry the service's own tooling throughout. There is also a generator tag that names the hosted service by name rather than giving a version number, which is a reliable tell once you know to look for it.

What a WordPress site publishes about itself

Everything below comes from ordinary page source, readable on any published site without special access. We verified each of these against live sites while writing this page.

The theme

Every theme lives in a predictable folder, and every stylesheet and script the theme loads carries that folder in its path. The folder is named after the theme itself. That means the theme name is usually sitting in the page source dozens of times over, which is why WordPress theme detection is reliable in a way that it simply is not on closed platforms.

Child themes, and why you often see two names

A child theme is a small theme that sits on top of another and overrides parts of it, which is the correct way to customise WordPress without losing your changes when the underlying theme updates. When a site uses one, you will see two theme names in the source rather than one: the child theme, which holds the customisations, and the theme it builds on. Seeing two names is not an error, it is a sign of a site that has been built properly.

Plugins

Plugins live in their own folder and follow the same pattern, so any plugin that loads a stylesheet or a script on the front end names itself in the process. This is often more revealing than the theme, because it tells you what the site actually does: how it handles forms, caching, SEO, analytics, ecommerce or memberships. Plugins that do their work entirely in the background will not appear, so the list you can see is a floor rather than a complete inventory.

The version

WordPress adds a generator tag naming itself and, by default, its exact version. Many sites remove it deliberately, since advertising a specific version to anyone scanning for known weaknesses is poor practice, so its absence tells you something too. Even when it is stripped, the software leaves plenty of other traces, including a standard set of endpoints that are hard to hide.

Why WordPress is so easy to identify

It comes down to openness. Because the software is public and runs on your own server, everything it needs to render a page has to be served from that server in a structure everyone can read. There is no build step that obscures the origin of the files and no proprietary system deciding what to reveal. The same qualities that make WordPress easy to extend, its predictable folder structure and its habit of loading theme and plugin assets by name, are exactly what make it easy to recognise.

That openness is also why the ecosystem around it is so large. Anyone can build a theme or a plugin and sell it without asking permission, which is why there is such a deep market of both, and why almost any requirement has something already built for it.

When detection gets harder

• Aggressive optimisation. Plugins that combine and rename stylesheets and scripts can strip the recognisable folder names out of the paths.
• Full page caching or a static export. A site served as pre-built pages may show far fewer traces than it otherwise would.
• Headless setups. When WordPress is used only to manage content and something else renders the front end, the visible site may show almost nothing of it.
• Deliberate hardening. Removing the generator tag and renaming folders is a recognised practice, and it does make a site meaningfully harder to fingerprint.

Even then, complete concealment is rare. It takes ongoing effort, and most sites that try still leave something behind.

Frequently asked questions

What is the difference between WordPress.org and WordPress.com?

WordPress.org distributes the free open source software that you install on your own hosting, with no restrictions on what you can add or change. WordPress.com is a paid hosting service built on that same software, where the hosting is managed for you but what you can install depends on your plan. The software is the CMS; the service is one way of running it.

Can you detect which WordPress theme a site is using?

Yes, and reliably. Themes live in a predictably named folder, and every file the theme loads carries that folder name in its path, so the theme name appears throughout the page source. This is the main reason WordPress theme detection works so much better than it does on closed platforms.

Why do some sites show two theme names?

Because they use a child theme, which is a small theme layered on top of another to hold customisations safely. Both names appear in the source: the child theme holding the changes and the theme it builds on. It is a sign of a well-built site rather than a problem.

Can you see which plugins a site uses?

Often, yes. Any plugin that loads a stylesheet or script on the front end names itself in the file path. Plugins that work entirely behind the scenes leave nothing visible, so what you can see is a minimum rather than the full list.

Can a WordPress site hide that it runs WordPress?

It can be made much harder to detect, by removing the generator tag, renaming folders and combining its files, and some sites do exactly that. Hiding it completely is difficult to sustain, and most sites that attempt it still leave recognisable traces behind.

Is WordPress free?

The software is free and always has been, and you can download, use and modify it without paying anyone. What costs money is everything around it: hosting, a domain, and any premium theme or plugin you choose to buy. Plenty of sites run entirely on free themes and plugins.

WordPress is the CMS that tells you the most about itself, which is precisely because it is open, self-hosted and built to be extended by anyone. If you want to build on it, the software is free and the only real decision is where to host it.

Try WordPress