You land on a competitor’s site, love how it works, and wonder what it is built with. If it runs WordPress, detective tools can even reveal its theme and plugins, which is gold for planning your own build. Checking takes under a minute with a free online detector, and this guide shows the reliable methods, including what to do when a tool draws a blank.
We will use dedicated detector sites first, then manual checks that confirm the result and expose extra details.
Quick Answer
Paste the site’s URL into a detector such as IsItWP or Wappalyzer (or the BuiltWith lookup) and it will tell you within seconds whether the site uses WordPress, and often which theme. To confirm manually, add /wp-admin to the domain: a WordPress login page is a giveaway. Viewing the page source and searching for “wp-content” settles it completely.
Method 1: Use an Online Detector Tool
- Copy the full URL of the website you want to check.
- Open a detector site such as IsItWP and paste the URL into the search box.
- Run the analysis and read the verdict: it reports whether WordPress powers the site.
- Scroll for extras; many detectors also list the theme name, hosting provider and some detected technologies.
- For a second opinion, run the same URL through Wappalyzer’s lookup or its browser extension.
What detectors actually look for
These tools scan the page’s code for WordPress fingerprints: generator meta tags, wp-content and wp-includes file paths, WordPress-specific cookies and script names. Security plugins can hide some fingerprints, which is why a “not detected” result is not absolute proof; that is when you switch to manual checks.
Method 2: Manual Checks That Never Lie
The login page test
Visit domain.com/wp-admin or /wp-login.php. A WordPress login screen confirms it instantly, although some sites move or protect their login URL.
The view-source test
Right-click the page, choose View Page Source, and search (Ctrl+F) for wp-content. Uploads, themes and plugins all live under that path on a standard install, so a match is conclusive. The same search often reveals the theme name in paths like /wp-content/themes/theme-name/.
The footer and feed clues
Some sites still show “Proudly powered by WordPress” in the footer, and domain.com/feed usually returns a WordPress-style RSS feed. These are supporting clues rather than proof on their own.
Tools like IsItWP and the Wappalyzer technology lookup are the standard free options. Our Web and WordPress guides go further, showing how to identify themes and plugins once you know a site runs WordPress.
Why the Answer Matters
Knowing a rival site runs WordPress tells you their results are achievable without custom development. The theme name points you to a starting design, and detected plugins reveal their recipe for speed, SEO or forms. For your own site, remember the mirror lesson: your stack is equally visible, which is one more reason to keep everything updated and remove unused plugins whose names advertise themselves.
Going Deeper: Finding the Theme and Plugins
Once a detector confirms WordPress, the next questions are which theme and which plugins. Theme detectors (IsItWP includes one, and dedicated theme-detector sites exist) read the active theme’s stylesheet and report its name, author and sometimes the parent theme if a child theme is in use. Plugins are harder: a profiler can only see plugins that output something on the page, such as a slider’s scripts, a form’s styles or an SEO plugin’s meta comments. That is why the view-source test remains powerful: search the source for “/wp-content/plugins/” and your browser will highlight the folder name of every plugin leaving public traces. Between the theme name and three or four identified plugins, you can usually reconstruct how a competitor built their best-looking page.
Why Some Sites Hide Their Stack (and Whether You Should)
Owners hide WordPress fingerprints for two reasons: to make automated attacks slightly harder (bots scan for known plugin paths) and to keep competitors from copying their setup, exactly as you are doing now. Security plugins can strip version numbers and generator tags. Total concealment is a losing game, though, because standard paths and behaviors leak through anyway; the energy is better spent on updates and hardening, which protect you whether or not your stack is known. Treat detection as a research tool and a reminder: anything you can learn about a rival’s site in one minute, anyone can learn about yours.
Reading the Fine Print: What Detectors Cannot Tell You
Detectors report what a site appears to run, and appearances have limits worth respecting in your research. They cannot see plugins that work entirely in the admin (backup tools, security logging), they can be fooled by CDNs that normalize file paths, and they occasionally mislabel heavily customized WordPress sites as custom builds or vice versa. Treat a detector result as a strong hypothesis, then confirm anything you plan to act on with the manual source check. Also respect the boundary between research and copying: learning that a rival uses WordPress and a certain theme is fair competitive intelligence; lifting their custom design, images or text wholesale is neither legal nor a strategy, since their ranking comes from far more than their stack. Use these tools to choose your starting point, then build something better and unmistakably yours.
Turning Detection Into a Research Habit
One check is curiosity; a habit is strategy. Keep a simple list of the five sites you admire or compete with, note their platform, theme and the plugins you identified, and revisit it twice a year. Stacks change: a rival’s move from a page builder to a leaner setup, or the appearance of a new plugin in their source, often signals a redesign, a growth push or a problem they are solving, all useful intelligence for your own roadmap. Pair each observation with one question (what changed for their visitors?) rather than copying the change blindly. Research of this kind keeps your own stack evolving on evidence, and it costs nothing but the ten minutes these free tools take to run.
Common Mistakes and Tips
Do not trust a single negative result; hardened sites hide their fingerprints, so confirm with the wp-admin and view-source tests. Do not confuse a WordPress blog on a subdomain with the main site’s platform, since large companies often mix systems. And when checking your own site, treat what you find as a security to-do list: hide the version number, keep plugins current, and avoid themes that leak excessive generator tags.
Conclusion
A detector tool gives you the answer in seconds, and manual checks confirm it beyond doubt. Paste the URL, look for wp-content in the source, and try the login page. Once you know a site runs WordPress, you are one step closer to learning exactly how it was built.
Frequently Asked Questions
Can a detector tell me which theme a site uses?
Often, yes. IsItWP and theme detectors read the active theme’s folder and style sheet, and may name the theme and link to it. Child themes and heavy customization can hide the parent theme name.
Why does a tool say a site is not WordPress when it clearly is?
Security and optimization plugins can remove generator tags and rename paths. The manual wp-content search in the page source usually still finds fingerprints.
Is it legal to check what a website is built with?
Yes. You are only reading publicly served code and metadata, the same information every visitor’s browser receives.
Can these tools detect plugins too?
Technology profilers like Wappalyzer and BuiltWith detect many common plugins from their scripts and styles, though the list is never complete because inactive-facing plugins leave no trace on the page.
How can I hide that my own site uses WordPress?
You can reduce fingerprints with a security plugin, remove version tags and protect the login page, but complete hiding is impractical; focus on updates and hardening instead.
Leave a Reply