How do bots find WordPress sites? The traces your site leaves

How bots find new websites, which traces give away WordPress, its version, plugins, and authors, and how to check them on your own site.

Key points

Bots do not look for your site in particular. They try addresses across the whole internet and read public lists of new websites.
Every WordPress site leaves traces: its login page, its folders, often its version number, the versions of its plugins, and the names of its authors.
You cannot hide WordPress completely. What protects you is keeping everything up to date and making logins hard to guess.

How bots find a site

Bots have two easy ways to find websites:

They try every address. The research tool ZMap can probe the entire public IPv4 address space on one port in under 45 minutes over a gigabit connection. Anyone can use tools like it.
They read public certificate lists. Certificates for HTTPS are recorded in public Certificate Transparency logs, which anyone can read. A new site becomes visible there as soon as it gets its certificate.

What gives WordPress away

Trace	Where to find it	What it shows
Login page	/wp-login.php	that the site runs WordPress
Folder names in the page source	/wp-content/themes/ and /wp-content/plugins/	the theme and many plugins by name
Generator tag	`<meta name="generator" content="WordPress …">` in the page source	the WordPress version
A plugin’s readme	/wp-content/plugins/name/readme.txt	the plugin’s version in the line “Stable tag”
List of authors	/wp-json/wp/v2/users	the authors’ names and slugs; the slug is often the same as the login name
XML-RPC	/xmlrpc.php	an older interface that also accepts logins

What bots do with these traces

A bot that finds a version compares it with lists of known flaws. Patchstack measured that heavily exploited flaws in WordPress software were first attacked about five hours after they became public. The guide Why do WordPress sites get hacked? explains where these flaws are.

Names of authors help with the next step: guessing passwords. Bots try them on the login page and through XML-RPC. The security company Sucuri described such attacks through XML-RPC in 2015.

Check your own site

Open these addresses on your own site, with your domain in place of example.com:

example.com/wp-json/wp/v2/users shows the authors that anyone can see. If you see the name you log in with, give that account a strong password and two-factor sign-in. Many security plugins can hide this list.
The page source of your home page: right-click the page and choose to view the source, then search for “generator”. If it shows the WordPress version, a security plugin can remove that line.
example.com/wp-content/plugins/name/readme.txt for one of your plugins. If it opens, bots can read its version. Up-to-date plugins matter more than hiding this.
example.com/xmlrpc.php. If it says “XML-RPC server accepts POST requests only.”, the interface is on. Turn it off if nothing you use needs it.

What you can do

Keep WordPress, plugins, and themes up to date. Hiding a version does not close a flaw.
Give every admin account a long, unique password and two-factor sign-in.
Limit login attempts, so that bots cannot keep guessing. Many security plugins offer this.
Turn off XML-RPC if nothing you use needs it.
Let a firewall block known scanners and attacks before they reach your site.

Next step

The page Web security tools lists firewalls and security plugins with their figures from WordPress.org and their CVE entries.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.