WordPress: Content management system

What WordPress is

WordPress is the most widely deployed content management system on the web. It is PHP software that a host runs, rather than a hosted service, so a WordPress detection identifies the application and says nothing about who operates the server. It leaves unusually clear public traces because its asset paths and REST endpoints are fixed by convention.

How DNSTrace.dev detects it

Detection reads the final HTTPS response and the first bytes of its markup. One matching signal is reported as strong evidence; two or more independent signals are reported as confirmed.

link header referencing /wp-json/ — The REST API discovery link WordPress advertises on the home document.
x-pingback — The XML-RPC pingback endpoint, still emitted by many installations.
x-redirect-by: WordPress — Added when WordPress itself issues the redirect.
/wp-content/ and /wp-includes/ in markup — The fixed asset directories that themes, plugins and core scripts load from.
meta generator naming WordPress — Declared by the site unless the theme removes it.

What a detection proves

The document was produced by WordPress.

What it does not prove

Where it is hosted, which version runs, or whether it is up to date. Version numbers in asset query strings are self-reported and frequently stripped or wrong.

Common questions

Can a WordPress site hide that it uses WordPress?

Partly. Headers and the generator tag can be removed, but the /wp-content/ asset path is hard to eliminate without substantial custom work, so it is usually the surviving signal.

Does WordPress tell me the hosting provider?

No. WordPress is software, not a host. The delivery platform and the announcing network are reported separately, and managed hosts such as Kinsta or Pantheon appear as their own detections.

Is WooCommerce reported separately?

WooCommerce is a WordPress plugin. DNSTrace.dev reports WordPress itself and does not enumerate plugins.