How to find the WordPress version of any site
The WordPress version of a site tells you whether it is behind on security releases: every update lists the vulnerabilities it fixes, and an old version number is the first thing automated scanners look for. You can find the version of any WordPress site from the outside, using only what it serves to every visitor, without logging in. The checker on this page reads the page's generator tag and server headers. If the version is hidden there, the steps below show where it usually still shows through.
Check your site
-
Run the check on the homepage
Enter the site's address into the checker on this page. If the site runs WordPress and has not hidden it, the result shows WordPress as the CMS and the version from the generator meta tag, which WordPress adds to every page by default in the form WordPress x.y.z. No version in the result does not mean the site is not WordPress: many themes, security plugins and optimisation plugins remove that tag.
-
Look at ver= on core files
Open the page source (Ctrl+U) and search for /wp-includes/. Core styles and scripts are loaded with ?ver= at the end, for example /wp-includes/css/dist/block-library/style.min.css?ver=x.y.z, and on core files that number is normally the WordPress version. Bundled libraries such as jQuery and all plugin and theme files carry their own version numbers, so only trust ver= on WordPress's own files, and some optimisation plugins strip the parameter altogether.
-
Open the RSS feed
Add /feed/ to the site address and look near the top for the generator line: <generator>https://wordpress.org/?v=x.y.z</generator>. Sites that remove the tag from their pages often forget the feed. Many sites also show the same version in a comment at the top of /wp-links-opml.php.
-
Do not rely on readme.html
The readme.html file in the site root is quoted in many old tutorials, but current WordPress releases do not print the exact version in it, so it only confirms that WordPress is installed. Its presence is harmless, and its absence proves nothing.
-
Compare with the current release
The official list at wordpress.org/download/releases/ shows the latest version of every branch. WordPress backports security fixes to older branches for a while, so an older branch is not unsafe in itself, but a site several security releases behind the latest version of its own branch is missing fixes.
-
If it is your site, update instead of hiding
Removing the generator tag only stops the casual lookup: scanners recognise WordPress and its version by files and behaviour anyway. Keep automatic minor (security) updates on, which WordPress enables by default unless something has switched them off, and keep plugins and themes up to date, because most WordPress break-ins come through plugins, not core.
How to verify the result
After updating your own site, run the check on this page again. If the generator tag is still there, it shows the new version straight away; clear the page cache first, or you may see the old one. If the tag is hidden, check ver= on a core file or the generator line in /feed/ instead. On someone else's site, treat the result as an indication: a cache can serve a page generated before the last update.
Tip: Use this on public pages only. Reading a site's page source and feed is what any browser does, but trying admin logins, scanning for vulnerable plugins or probing hidden paths on a site you do not own is unauthorised testing. If a site you care about runs an outdated version, tell its owner.