Methodology and data dictionary
This page explains where the data comes from, how each website was checked, and what every column means. In short: we visited every domain ourselves, so each site in the list was confirmed to run WordPress during the scan.
Source of domains
We started from top-100-million-domains (WebsiteLaunches), a public ranking of the 100 million most popular domains, and scanned the top 20 million of it. The ranking position is kept in the rank column, so you can sort by popularity.
How a site is confirmed as WordPress
Each homepage was downloaded (HTTPS first, falling back to HTTP and the www. host) and scored on WordPress evidence:
- Definitive markers: the WordPress generator meta tag, the WordPress REST API link in the HTML or the HTTP
Linkheader, X-Pingback headers, WordPress redirect headers and WordPress-only hosting platforms. - File evidence:
/wp-content/and/wp-includes/files served by the site itself. Files hot-linked from other websites don't count, so a non-WordPress site embedding a WordPress image isn't mislabelled. - Supporting signals: WordPress cookies, emoji and embed scripts, block-editor markup and plugin fingerprints such as Yoast SEO or Elementor markup.
- Deep probes for unclear cases: the REST API index at
/wp-json/,/wp-links-opml.php, the RSS feed generator and the login page. Each probe checks the response content, so servers that answer every URL with "200 OK" can't create false positives. - Counter-evidence: generator tags of other systems (Drupal, Joomla, Wix, Shopify…) lower the score.
Sites scoring 100 or more are high confidence (99% of the list); 60–99 is medium. Lower scores are not included. Domains that redirect to a different domain are excluded too, so each row is a site in its own right.
Placeholder and broken installs
18,895 WordPress installs were set aside in a separate bonus file instead of the main list:
- Coming soon / maintenance mode: 10,186
- Untouched default installs ("My Blog – My WordPress Blog"): 3,863
- Errors (database errors, suspended accounts, 404/5xx homepages): 3,658
- Private WordPress.com sites: 1,188
An error code on its own doesn't remove a site: many live sites answer automated visitors with 403 or 503 while still sending their normal page, and those stay in the main list.
Columns
| Column | Meaning |
|---|---|
rank | Position of the domain in the source ranking of the top 100 million domains (lower = more popular). |
domain | Domain name. |
url | Final homepage URL after redirects. |
title | Homepage title. Empty when the site hides it behind a bot-protection page. |
language | Language declared in <html lang>, e.g. en-us, de-de, ja. |
country_code / country | Country from a country domain extension (.de → DE). Empty for .com, .org, .net, .io and similar. |
wordpress_version | WordPress version when the site exposes it; many hide it on purpose. |
theme / child_theme | Active parent theme folder and child theme folder. |
plugins / plugin_count | Plugins whose files load on the homepage (folder names, ';'-separated) and how many. |
ecommerce | WooCommerce, Easy Digital Downloads, Ecwid… when detected. |
page_builder | Elementor, Divi, WPBakery, Avada, Beaver Builder, Bricks, Oxygen… when detected. |
seo_plugin | Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework… when detected. |
multilingual | WPML, Polylang, TranslatePress, Weglot, GTranslate when detected. |
hosting | Hosting provider when it identifies itself in HTTP headers (WP Engine, Kinsta, WordPress.com/VIP…). |
web_server | Server header (nginx, apache, cloudflare, litespeed…). |
confidence | high = definitive WordPress marker; medium = strong evidence from WordPress files served by the site. |
last_checked | Date the site was checked (UTC). |
Freshness
Sites were checked between September 30, 2026 and October 3, 2026; each row has its own last_checked date. Websites change over time, so expect a small share of sites to switch platform, theme or plugins in the months after a scan.
Known limits
- Plugins are only visible when they load on the homepage. Admin-only plugins (backups, security, many SEO settings) can't be seen from outside.
- Country comes from the domain extension; .com sites are global even if the business is local.
- Hosting is only filled in for hosts that identify themselves in HTTP headers.
- The scan covers the top 20 million domains of the ranking, not every website in existence.
- No personal data or email addresses are collected.