WordPress Version Checker
Enter a website and see which WordPress version it runs, found from six independent signals. Then see whether that version is current, outdated or marked insecure by WordPress.org, how many releases behind it is, and how to update safely.
- Six detection methods
- Checked against WordPress.org
- Update and hide guides
Want the full picture? Run the WordPress Security Checker, or list plugins with the Theme & Plugin Detector.
Six places a WordPress version can hide
Removing one signal rarely removes them all. The tool checks each one and tells you which still give the version away.
Generator tag
The meta generator tag in the page head. WordPress adds it by default, and many themes and plugins remove it.
Core file numbers
WordPress stamps its own CSS and JavaScript files with ?ver= and the version. jQuery and plugin files carry their own numbers and are ignored.
RSS feed
The feed's generator line often names the exact version even when the page head does not.
Login page
The login screen loads WordPress files stamped with the version, even on sites that hide it elsewhere.
readme.html
The readme file that ships with WordPress states the version under the logo, until someone deletes it.
OPML export
wp-links-opml.php writes a generator comment with the version, and almost nobody remembers it exists.
What the status labels mean
The labels come from WordPress.org's own release list, not from a guess.
| Status | Meaning | What to do |
|---|---|---|
| Up to date | The newest public release. | Keep automatic updates on. |
| Outdated | A newer release exists. Fixes ship in the newest versions first. | Back up and update. |
| Insecure | WordPress.org lists the version as having known security flaws. | Update as soon as you can. |
| Newer than public | A beta, release candidate or development build. | Not for a live site. |
How to check and act on a WordPress version
Three steps from a URL to a plan.
Enter the site
Use the home page of any public WordPress site, or switch to Enter a version if you already know the number.
Read the verdict
See the status, the releases behind, where the version shows up, and how sure the tool is.
Update, then hide
Follow the update steps first. Hiding the version only removes an easy shortcut, so it comes second.
Version numbers and security, in plain terms
A few things that stop the version number being misread.
Hiding is not protecting
Scanners try known flaws whether or not the version is shown. Hiding helps a little. Updating is what closes the hole.
Minor releases matter most
6.4.1 to 6.4.2 is usually a security fix. Keep minor updates automatic even if you update major versions by hand.
Plugins are the bigger risk
Most WordPress compromises come through plugins and themes. Check them too, not just core.
Test on a copy
For a site that earns money, update a staging copy first and click through the key pages and forms.
Back up first
A backup you can restore turns any failed update into a short delay instead of a crisis.
Cached copies can mislead
A CDN or cache may serve an old feed or file. If signals disagree, the tool says so and shows the likeliest answer.
What a WordPress version checker does and why the version matters
A WordPress version checker finds which release of WordPress core a site runs and compares it with the releases WordPress.org has published. The version leaks in more places than most owners expect: the generator tag in the page head, the version numbers on core CSS and JavaScript files, the RSS feed, the login page, the readme.html file and an old OPML export file. This tool reads all six and lets each signal vote, so you can see which ones still give the version away.
The version matters because updates carry security fixes. WordPress releases are numbered in steps: major releases add features, and the third-number releases are maintenance and security fixes. By default WordPress applies minor core releases automatically. Plugins and themes are not updated automatically by default, and WordPress says only the latest version is officially supported, with fixes for older versions backported as a courtesy. A site that falls behind is running code with known, published fixes.
A status of outdated or insecure comes from WordPress.org's own data, not a guess, and it is a signal to update, not proof that a site has been hacked. Hiding the version is a separate, smaller step. The WordPress documentation says updating matters and calls security through obscurity generally unsound as a main strategy, so update first and treat hiding as an extra.
When to check a WordPress version
Check whenever you need to know whether a site is current, and not only when something goes wrong.
During a site audit or handover
Record the version and its status for every WordPress site you manage or inherit. A site several releases behind is a clear first item on the to-do list.
To confirm updates are working
If you rely on automatic updates, check that the site really moved to the latest minor release. A stuck update can leave a site behind without anyone noticing.
Across a portfolio of client sites
Agencies and freelancers can run the same quick check on each client site to find which ones need attention first, without logging in to each dashboard.
After a migration or restore
Restoring an old backup can bring back an old core version. A quick check after the move shows whether the live site is as current as you expect.
Before and after hiding the version
See which of the six places still reveal the number. Removing the generator tag alone does not hide a version that the feed or core file addresses still show.
When the site blocks detection
If the version cannot be found from outside, enter the number you see in the dashboard under Updates to get the same status check from WordPress.org.
WordPress version mistakes and how to fix them
Most trouble comes from delaying updates or from believing that hiding a version is the same as protecting it.
Hiding the version instead of updating
What goes wrong: Removing the number can make a site harder to identify, but it does not remove the flaws in an old release. Automated scanners can also try known issues without reading the version first.
The fix: Take a backup and update to the current release first. Then remove the generator tag as a small extra, not as the fix.
Turning off minor automatic updates
What goes wrong: Minor releases carry security and maintenance fixes. Turning them off to avoid surprises means a site can sit on a known-fixed flaw for months.
The fix: Leave minor core updates on automatic, which is WordPress's default, and keep a working backup so a bad update becomes a short delay and not a crisis.
Updating a live shop without a test
What goes wrong: A major update can clash with a theme or plugin. On a site that takes orders or leads, a broken checkout or form costs real money.
The fix: Update a staging copy first, click through the key pages, forms and checkout, then update the live site. Apply major releases within a few weeks, not months.
Hiding in only one place
What goes wrong: A site removes the generator tag but still shows the version in the RSS feed, on core file addresses or in readme.html, so a checker, or an attacker, finds it anyway.
The fix: Check all six places. Delete or block readme.html and the OPML file, and remove the generator from the feed as well as the page head. Re-test after each update, since files can return.
Trusting a cached answer
What goes wrong: A CDN or page cache may serve an old feed or file, so two signals show different versions and it looks like an error. Another cause is an old file left on the server.
The fix: Purge the cache, then re-run the check. The tool lists every value it saw and shows the likeliest one, so look at which signal is the outlier.
Only checking core
What goes wrong: A current WordPress core does not protect a site with outdated plugins or themes. A flaw in any one of them can be enough, and plugins are not updated automatically by default.
The fix: Check plugins and themes with the Theme & Plugin Detector and the dashboard, update them on a regular schedule, and delete the ones you do not use.
WordPress version terms explained
- WordPress core
- The main WordPress software, separate from themes and plugins. Core updates are released by the WordPress project and versioned with numbers such as 6.8 or 6.8.1.
- Major release
- A release that adds features and changes, shown by the first two numbers of the version. It is applied automatically only on fresh installs of recent versions, not on existing sites by default.
- Minor release
- A third-number release, such as 6.8.1, that fixes bugs and security issues without adding features. WordPress applies these automatically by default.
- Insecure status
- A label from WordPress.org for versions with known security flaws that later releases fix. It is a strong reason to update, not a sign that your site has been attacked.
- Generator tag
- A meta tag in the page head that WordPress adds by default and that names WordPress and its version. Themes and plugins often remove it.
- readme.html
- A file shipped with WordPress that states the version number under the logo. It can come back after an update, so deleting it works best alongside a server rule that blocks it.
- Automatic background updates
- WordPress's built-in system for installing certain updates without you clicking. It handles minor core releases by default, while plugin and theme updates are not automatic by default.
- Staging site
- A private copy of your site used to test updates before applying them to the live one, so a broken update never reaches your visitors.
Related tools, guides and services
The version is only one layer. These check the other parts of a WordPress site.
WordPress Security Checker
Run passive checks for exposed files, usernames, XML-RPC and headers on a WordPress site you own.
ToolWordPress Theme & Plugin Detector
List the visible theme and plugins and see which are outdated or abandoned.
ToolWebsite Technology Checker
Confirm what a site is built with when WordPress is not detected.
ToolSecurity Headers Checker
Grade the browser protections the server sends alongside the page.
ServiceSEO audit service
Get a prioritised audit of technical issues that affect your WordPress site's search performance.
Built by
Madhav Kushwaha
WordPress runs a large share of the web, and an out-of-date version is one of the easiest things for an attacker to spot. I built this checker to show exactly where a version leaks, to compare it with WordPress.org's own data instead of guessing, and to give a plan that a site owner can follow the same day.
WordPress Version Checker: Frequently Asked Questions
More free SEO tools
WordPress versions are one layer. These tools check the rest.