WordPress version checker
Enter a domain and see whether it runs WordPress and whether it gives its versions away in its page source. Two page fetches, like a visitor makes. The versions themselves are shown only to the site's owner, in Stackbrace.
What the result shows
- Whether the site runs WordPress
- The WordPress version in the generator tag, if shown
- Plugin and theme versions visible in the page, and whether readme.html is public
Read-only: the same lookups a browser or a mail server makes, nothing changed, nothing stored beyond ten minutes. What Stackbrace asks for.
Why does a visible version matter?
Attack tools read the page source first. A version number tells them exactly which known holes to try, instead of guessing. Hiding it does not fix a hole, but it stops the site being the easy pick.
How do I hide the WordPress version?
Remove the generator tag (most security plugins do this, or a line in functions.php), delete readme.html from the site's root, and keep plugins current so the version strings in their script addresses are not old ones.
Is this a vulnerability scan?
No. It reads what the page shows. Stackbrace's daily scan takes every version it can see and checks it against the known holes in Wordfence Intelligence's list, and tells you when one is being used in attacks.
Every day, not just today
Stackbrace checks every WordPress site's core, plugins and theme against known security holes every day, and alerts you when one is urgent. Start free with one site.