You can learn a lot about a business from the way it builds its website. The theme it picked, the plugins it runs, the host it pays for, and the CDN that keeps it fast are not random. They are decisions, and every one of them is readable from the outside if you know where to look.
WordPress makes this especially easy to study, because it powers more than 40% of all websites and leaves recognisable traces in almost every page it serves. Yet most people stop at the theme name. The theme is the paint. The plugins, the host, the CDN, and the performance setup are the engine, and that is where the interesting decisions live.
This guide walks through how to read the whole stack of any WordPress site, layer by layer. You will see the exact signals to look for, the shortcuts that save you the manual work, and the honest limits of what any outside tool can detect.
What Is a WordPress Tech Stack, and Why It Matters
A "tech stack" is just the collection of technologies a site is built on. For a WordPress site, it breaks into five layers:
- Theme is the design foundation and the templates that render each page.
- Plugins add features: SEO, forms, caching, security, eCommerce, and hundreds of other jobs.
- Hosting is the server environment the site runs on, from budget shared plans to managed WordPress platforms.
- CDN is the network that caches and serves assets close to visitors, and often shields the origin server.
- Performance setup is how those pieces are tuned: caching, compression, image handling, and response time.
Reading the stack answers questions a keyword tool never will. Why does a competitor load faster than you? Which plugins power the forms and SEO on the sites that outrank you? Is that agency's "custom platform" really just Elementor on shared hosting? The stack holds the answer.
A quick example
Say you find two competitors ranking above you. One runs a lightweight block theme on Kinsta behind Cloudflare with WP Rocket for caching. The other runs a heavy multipurpose theme on budget shared hosting with no caching at all. That single comparison tells you where each site's speed advantage comes from, and which one is beatable this quarter.
The Fast Way: One Report Instead of Six Checks
Before the manual methods, here is the shortcut. Each layer below can be checked by hand, but doing all five for every site gets tedious quickly. Our WordPress Site Tech Stack Report runs every check at once: paste a URL and it returns the theme, the plugins grouped by category, the hosting, the CDN, and a speed snapshot, then hands you a downloadable PDF.
If you research sites as you browse rather than one URL at a time, the free Chrome extension reads the page you are on directly and can catch details a server-side fetch sometimes misses. Both use the same signals described below, so it helps to understand what is actually happening under the hood.
Layer 1: Find the Theme
WordPress loads a theme's stylesheet and assets from a predictable folder. That folder name is the theme's slug, and it is usually sitting right in the page source.
Open the page source
Right-click the page and choose "View Page Source", or add view-source: before the URL in your address bar.
Search for the themes path
Press Ctrl+F (Cmd+F on Mac) and search for /wp-content/themes/. The name right after it is the active theme, for example /wp-content/themes/astra/.
Confirm the details
Open /wp-content/themes/theme-name/style.css directly. The header comment lists the theme name, version, and author. Cross-check the slug on WordPress.org to confirm a public theme.
astra and astra-child. The child holds the customisations; the parent is the real theme you would buy or study.
For a deeper walkthrough of theme detection, including premium themes that are not in the public directory, see our guide on how to find what theme a WordPress site uses.
Layer 2: Find the Plugins
Plugins follow the same pattern as themes. Any plugin that loads front-end CSS or JavaScript exposes a folder under /wp-content/plugins/, and that folder name maps to a specific plugin.
Search the page source for /wp-content/plugins/ and note every folder name that appears. A few you will recognise instantly:
/plugins/woocommerce/means the site sells online with WooCommerce./plugins/wordpress-seo/is Yoast SEO;/plugins/seo-by-rank-math/is Rank Math./plugins/elementor/means pages are built with Elementor./plugins/wp-rocket/points to premium caching, a sign the owner takes speed seriously./plugins/contact-form-7/or/plugins/wpforms/handle the forms.
Grouping what you find by job (SEO, forms, caching, security, eCommerce) turns a list of folders into a picture of strategy. If three competitors all run the same caching and SEO plugins, that is a pattern worth copying.
Our full guide on finding what plugins a WordPress site uses covers the manual and automated methods in more depth.
Layer 3: Identify the Hosting
Hosting is not in the HTML. It is in the HTTP response headers, the metadata a server sends back with every page. You can read them in your browser's Network tab (open developer tools, reload, click the first request, and look at Response Headers) or with a command like curl -I https://example.com.
Managed WordPress hosts add their own fingerprints. Once you know them, hosting detection takes seconds:
- WP Engine sends headers such as
x-wpe-loopback-upstream-addrorx-powered-by: WP Engine. - Kinsta sends
x-kinsta-cache. - Pantheon sends
x-pantheon-styx-hostname. - Hostinger sends
panel: hpaneland its ownx-hcdn-*headers. - Flywheel sends
x-fw-server: Flywheel.
When there is no vanity header
Budget and self-managed hosts (many shared plans, a plain VPS on DigitalOcean or Hetzner) send no identifying header at all. The Server value only tells you the web-server software, like nginx or Apache. In those cases the reliable answer comes from an IP or DNS lookup, not the headers, and any honest tool should say "not detected" rather than guess.
Layer 4: Spot the CDN
A CDN sits in front of the origin server and usually announces itself in the headers too. The same header check that reveals the host reveals the CDN:
- Cloudflare adds
cf-rayandserver: cloudflare. - Amazon CloudFront adds
x-amz-cf-idandx-amz-cf-pop. - Fastly adds
x-served-byvalues starting withcache-. - Akamai shows
server: AkamaiGHost. - Sucuri, a security firewall as well as a CDN, adds
x-sucuri-id.
One caveat worth remembering: a CDN header tells you what is in front of the site, not who runs the origin. A Kinsta site sitting behind Cloudflare will show both x-kinsta-cache and cf-ray. That is expected: Kinsta is the host, and Cloudflare is the delivery layer in front of it.
Layer 5: Measure the Speed
Speed is the layer that ties the others together. A great theme on a slow host still feels slow. Three numbers give you a fast read:
- Server response time (TTFB) is how long the server takes to send the first byte. Google treats anything under 800 milliseconds as good.
- Page weight is how heavy the HTML and its assets are. Bloated pages punish mobile visitors most.
- Request count is how many separate files the page pulls in. More requests usually means slower rendering.
The stakes are real. Google's research with SOASTA found that as a page's load time grows from one second to three, the probability that a visitor bounces climbs by about 32%. Speed is not a vanity metric. It moves conversions and revenue.
Where Detection Fails (and How to Read Around It)
No outside tool sees everything, and it is worth knowing the blind spots so you trust the results you do get.
- Hardened sites can strip the WordPress generator tag, rename
wp-content, or block automated requests. Detection gets thinner, though rarely impossible. - Admin-only plugins leave no front-end footprint, so they stay invisible from the outside.
- Premium themes and plugins that are not in the public directory still show a folder name, but without the extra detail a public listing would add.
- A CDN masks the origin, so when Cloudflare or Sucuri answers the request, the real host can hide behind it.
When a check comes back empty, that is information too. A site with no visible caching plugin and a slow response time is a site with a speed problem, whether or not you can name every tool it runs.
Tools to Use
You can do all of this by hand, but a few tools make it faster.
Free tools worth bookmarking
Tech Stack Report
Paste a URL and get the theme, plugins, hosting, CDN, and speed in one report, with a downloadable PDF. Best for audits and proposals.
FreeWP Theme Detector (Chrome)
Reads the page you are on directly in the browser and lists the theme and plugins in one click. Best for research while you browse.
FreeView Source + Headers
The manual method: search the source for /wp-content/ paths and read response headers in the Network tab. Best for spot checks.
PageSpeed Insights
Google's lab and field performance report for Core Web Vitals. Best paired with a stack check for the full speed picture.
FreeWant the whole workflow from detection to a written plan? Our guide to WordPress competitive analysis shows how to turn these findings into action, and the Is It WordPress? checker is the quickest way to confirm the platform before you dig in.
See the full stack in one step
Skip the six manual checks. Paste any URL into the WordPress Site Tech Stack Report and get the theme, plugins, hosting, CDN, and speed, ready to download as a PDF.
Run a free tech stack reportFrequently Asked Questions
What is a WordPress tech stack?
It is the set of technologies a site is built on: the theme, the active plugins, the hosting provider, any CDN in front of it, and the performance setup that ties them together. Reading the stack tells you how a site looks, loads, and ranks.
Can you tell what plugins a WordPress site uses?
Often, yes. Plugins that load front-end CSS or JavaScript expose a /wp-content/plugins/plugin-name/ path in the page source. Plugins that only run in the admin area or add no front-end assets are harder to see from outside.
How do you find out who hosts a website?
Read the HTTP response headers. Managed hosts leave clear fingerprints, such as x-kinsta-cache for Kinsta or x-wpe-loopback-upstream-addr for WP Engine. When there is no vanity header, the Server value plus an IP or DNS lookup are the next best clues.
How can I tell if a site uses a CDN?
CDNs add their own response headers. cf-ray means Cloudflare, x-amz-cf-id means Amazon CloudFront, x-served-by: cache-... means Fastly, and x-sucuri-id means the Sucuri firewall. A quick header check confirms it.
Is checking a website's tech stack legal?
Yes. Reading a page's public HTML and HTTP response headers is the same data your browser receives on every visit. It does not involve logging in or accessing anything private.
Read the Whole Site, Not Just the Paint
Key Takeaways
- A WordPress tech stack has five readable layers: theme, plugins, hosting, CDN, and speed.
- Themes and plugins show up as
/wp-content/paths in the page source. - Hosting and CDN live in the HTTP response headers, where managed providers leave clear fingerprints.
- Speed ties it together: server response under 800 ms is Google's mark for good.
- When a signal is missing, an honest tool says "not detected" instead of guessing.
Start with the theme, then work down through the plugins, host, CDN, and speed. Do it by hand a few times so the signals make sense, then let the Tech Stack Report handle the repetition. Once you can read a site's whole stack in a minute, competitor research, client audits, and your own site's tune-ups all get a lot easier.