WP Site Finder

Bulk WordPress discovery tool. Feed it a list of domains (or let it generate one), and it finds which ones run WordPress.

Works by checking HTTP headers, page content, and known WP paths like /wp-login.php, /xmlrpc.php, /wp-json/, etc.

Features

• Multi-threaded scanning (default 20 workers, adjustable)
• Built-in domain generator with country-specific TLDs (22 countries)
• Niche-based word lists (tech, food, travel, finance, health, fashion, blog)
• Resume support if scan gets interrupted
• Parked/expired domain filtering
• Proxy support
• SSL verification toggle
• 3-layer detection: headers, body content, known WP paths

Setup

Windows

git clone https://github.com/V3n0mSh3ll/wp-site-finder.git
cd wp-site-finder
pip install -r requirements.txt
python wp_finder.py --help

Linux (Ubuntu/Kali/Debian)

sudo apt update && sudo apt install python3 python3-pip git -y
git clone https://github.com/V3n0mSh3ll/wp-site-finder.git
cd wp-site-finder
pip3 install -r requirements.txt
python3 wp_finder.py --help

Termux (Android)

pkg update && pkg install python git -y
git clone https://github.com/V3n0mSh3ll/wp-site-finder.git
cd wp-site-finder
pip install -r requirements.txt
python wp_finder.py --help

Only dependency is requests.

Quick Start

Scan a single domain:

python wp_finder.py wordpress.org

Scan multiple domains from file:

python wp_finder.py -i targets.txt -o results.txt -t 40

Domain Generation

Generate 3000 candidate domains and scan them right away:

python wp_finder.py --generate targets.txt --count 3000 --scan -t 40

Target a specific country:

python wp_finder.py --generate targets.txt --count 2000 --country pk --scan -t 40

Use niche-specific words:

python wp_finder.py --generate targets.txt --count 2000 --niche tech --scan -t 40

Supported countries: pk, in, us, uk, au, ca, de, fr, nl, za, sa, ae, bd, ng, eg, tr, br, mx, jp, kr, id, my

Available niches: tech, food, travel, finance, health, fashion, blog

All Options

python wp_finder.py --help

Flag	What it does
-i, --input	File with one target per line
-o, --output	Save confirmed WP sites here (default: wp_live.txt)
-t, --threads	Number of concurrent workers (default: 20)
--timeout	HTTP timeout in seconds (default: 10)
--proxy	HTTP/HTTPS proxy (e.g. http://127.0.0.1:8080)
--no-verify	Skip SSL certificate verification
--resume	Skip previously scanned targets
--generate	Generate a candidate domain list file
--scan	Scan generated list immediately
--count	Number of candidates to generate (default: 2000)
--tlds	Comma-separated TLDs for generation
--country	Country code for TLD selection
--worldwide	Use global TLD list
--niche	Niche-specific seed words
--words	Custom word list file

Examples

# scan domains from file with 40 threads
python wp_finder.py -i domains.txt -o wp_live.txt -t 40

# generate worldwide domains and scan
python wp_finder.py --generate targets.txt --count 5000 --worldwide --scan -t 40

# resume a stopped scan
python wp_finder.py -i targets.txt -o wp_live.txt -t 40 --resume

# scan through a proxy
python wp_finder.py -i targets.txt --proxy http://127.0.0.1:8080

# generate niche + country combo
python wp_finder.py --generate targets.txt --count 3000 --country pk --niche tech --scan -t 40

How Detection Works

1. HEAD request to check for WordPress-specific headers (X-Pingback, X-Powered-By, cookies)
2. GET request to scan page source for WP signatures (wp-content, wp-includes, wp-json, etc.)
3. Path probing to hit known WP endpoints (/wp-login.php, /xmlrpc.php, /wp-json/, /readme.html, /wp-admin/)
4. Parked and expired domains are automatically filtered out

Author

V3n0mSh3ll

• GitHub: github.com/V3n0mSh3ll

Disclaimer

This tool is for authorized security testing and research only. Do not scan domains without permission. The author is not responsible for any misuse.

License

MIT