How to find the WordPress version of any site (and check a whole client list at once)

If you run an agency or maintain sites for clients, you eventually need the same boring answer for every domain on a list: what WordPress version is this site running, and is it behind?

Doing it by hand works for one site. For fifty, it doesn't. Here are both ways.

Checking one site by hand

Open the site and try these, in order of how often they work:

1. The generator meta tag. View source (Ctrl+U) and search for generator. A site that hasn't stripped it tells you outright: <meta name="generator" content="WordPress 6.9.8">
2. The REST API link header. Load the page in DevTools, look at the response headers of the first request, and check for a Link header pointing at /wp-json/. Its presence proves WordPress even when the generator tag is gone. Loading https://example.com/wp-json/ directly usually returns JSON too.
3. Asset version strings. Search the HTML for ver=. WordPress appends the core version to its own CSS and JS files, though plugins put their own versions there too, so read it as a hint, not proof.
4. readme.html — the classic trick, and mostly dead in 2026. I checked it while writing this: wordpress.org returns 404 and techcrunch.com returns 403. Hosts and security plugins block it now.

A site can hide the generator tag and still be WordPress. Of the ten sites I tested for this post, one (blog.mozilla.org) exposed no version anywhere, while still being obviously WordPress from the /wp-json/ link.

Checking a whole list at once

For a list of domains I use a tool I built on Apify: Tech Stack Detector. There is a ready-made preset for this exact job: WordPress Version Checker. Paste your domains, run it, and you get one row per site with the version and the evidence behind it.

Set Only websites using to WordPress and non-WordPress sites are left out of the results entirely — handy when the list is a mixed bag of client domains.

A real run

Ten sites, one run. The current stable release at the time of writing is 7.1.1 (from WordPress's own version-check API):

The plugin layer comes along for free: the run flagged Yoast SEO on TechCrunch, Elementor on elementor.com, and WooCommerce on woocommerce.com.

That's the part that matters for an audit. "Three of your client sites are two releases behind, and two of them run an SEO plugin you're paying for twice" is a concrete finding you can act on, not a vibe.

From code

curl -X POST "https://api.apify.com/v2/acts/fagundes_victor~tech-stack-detector/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["techcrunch.com", "variety.com", "nginx.com"], "technologies": ["WordPress"]}'

Each row carries technologies with a version, a confidence, and the evidence that triggered the match, so you can check any result by hand instead of trusting a black box.

Honest limitations

• A hidden version stays hidden. If a site strips the generator tag, the tool reports WordPress without a version, exactly like your manual check would. It won't guess.
• Sites behind aggressive bot protection are reported as blocked rather than silently returning an empty stack — and blocked rows are not charged.
• It reads what the server sends, with no browser, so a run over dozens of domains takes seconds.
• Cost is $20 per 1,000 websites analyzed, less on paid Apify plans, and Apify's free plan comes with monthly credits, so a client list of 50 sites costs about a dollar.

One caveat about version numbers

An old version number is a signal, not a verdict. Managed hosts sometimes backport security fixes without bumping the number shown, and some sites pin a release deliberately. Treat "two releases behind" as the reason to open a conversation, not as proof that a site is vulnerable.

I built the tool used here. The manual checks above work on their own, and everything in the table was measured while writing this post.