CMS Detector

WordPress, TYPO3, Joomla, Shopify or a website builder? This check identifies the system behind a website and verifies whether the version in use is still maintained. For WordPress, you also see the detected plugins with their version, available updates and publicly known vulnerabilities.

Ideally enter the homepage. Each website can be checked several times per hour.

How to read the result

We evaluate what every website delivers publicly anyway: source code, server responses and, for WordPress, the info files of the plugins loaded on the page. We do not try out unknown plugins. The check therefore puts less load on your website than a single page visit.

OKThis point is implemented correctly.
ReviewNot an acute error, but room for improvement.
ProblemLikely has a negative effect and should be fixed.
InfoFor information, without rating.

System and version

We detect common content management systems, shop systems, website builders and frameworks. If the version is visible, we compare it with the official support periods. Red means this version no longer receives security updates. A hidden version is good from a security perspective, but then the status can only be checked in the backend.

Hosted website builders

With services such as Shopify, Wix, Squarespace or Webflow, the provider installs system updates itself. What matters here are mainly the apps and extensions you have added.

WordPress plugins and themes

For every detected plugin we read the installed version from its public info file (readme.txt), for themes from style.css. We then compare it with the current version in the official directory. If the column “Version source” says “uncertain”, the information only comes from a file parameter and is not rated.

Known vulnerabilities

We compare the detected versions with the open WPVulnerability database. It combines reports from several major sources such as the CVE list, Wordfence and Patchstack. Red means a vulnerability is publicly known for exactly this version. The column “Fixed in” names the version that closes the issue.

What the check cannot see

Plugins that load nothing on the checked page, for example for security, backups or administration, are invisible from outside. Premium plugins without an entry in the official directory cannot be compared with a current version. A green result is therefore no substitute for a look into the backend.

Why outdated systems are so dangerous

Most hacked websites are not targeted specifically. Bots scan the web around the clock for versions with known vulnerabilities and strike automatically as soon as they find one. Whether your website is hit depends mainly on whether updates are installed.

With WordPress, the risk almost always lies in the plugins. A typical website uses twenty or more, each with its own update cycle. Once a vulnerability is published for a plugin, it often takes only hours until the first automated attacks start.

Systems without plugins age too. Every CMS version receives security updates only for a certain time. After that, newly discovered vulnerabilities remain open, and an upgrade is no longer optional but essential.

The good news: regular updates, a lean selection of plugins and working backups reduce the risk dramatically. The check shows you in seconds where to start.

Hide the WordPress version in the source code

<?php
// functions.php in a child theme or a small custom plugin:
// Stop printing the WordPress version in the source code
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

Hiding the version does not replace updates, but it makes automated searches for vulnerable versions harder. Many security plugins offer the same setting with one click.

Frequently asked questions about CMS detection

Is it legal to check the CMS of someone else’s website?

Yes. We only retrieve content that every website delivers publicly to all visitors, just like search engines do. No logins are tried and no vulnerabilities are tested. The check is most useful for your own website or those of your clients, though.

The result reports a vulnerability. How urgent is it?

Very urgent, especially with severity “high” or “critical”. Install the update to the version shown today if possible. If no update exists yet, deactivate the plugin temporarily or ask the vendor for a solution.

Why does the check not find all my plugins?

Only plugins that output files or tags on the checked page can be detected. Many plugins work only in the background or only on subpages. If needed, also test pages with a form, shop or slider.

The version shown does not match my backend.

This rarely happens, for example if a plugin author has not maintained the info file or a cache delivers an old copy. The version shown in the WordPress backend under “Plugins” is always authoritative.

Where does the data on vulnerabilities and support periods come from?

Vulnerabilities for WordPress plugins and themes come from the open WPVulnerability database (wpvulnerability.com), which combines the CVE list, Wordfence, Patchstack and other sources. Support periods of CMS and shop systems come from the vendors’ official release information. We check both sources at least daily.

How can I prevent others from detecting my CMS?

A system can hardly be hidden completely. It makes sense to hide version numbers in the source code and public info files such as readme.html. More important than disguise, however, are current versions, because bots often simply try known vulnerabilities blindly.

Are my entries stored?

We store the checked address and the result anonymously for statistical purposes. Your IP address is not stored. More in our privacy policy.

See all 35 tools

WordPress Security Check
Finds common weaknesses such as exposed usernames, outdated versions and public error logs.
Security Headers Check
Checks which protective headers your server sends: HTTPS, HSTS, CSP, framing protection, cookies. With a grade and a snippet.
PHP Version Check
Checks whether your server reveals its PHP version and whether it still receives security updates.
Third-Party Checker
Shows every external service your website loads on the first visit, with provider, headquarters and data volume.

Updates you no longer have to think about

We take care of the ongoing maintenance of your website: updates of system, plugins and theme, tested and with a backup, plus monitoring for new vulnerabilities. You only hear from us when there is something to decide.

Get in touch