Adding a site

Paste the address of a site and press Look it up. WP Moo looks at the site from the outside, the way a visitor does, and fills in what it finds, usually within a few seconds and at most 20 for a slow site. You only confirm or correct it. Nothing is installed on your site.

What WP Moo finds

Website: whether the site runs WordPress, and whether it's a WooCommerce shop. We see it in the code of your home page and in the REST API (the /wp-json/ address WordPress opens for apps).
Main address: where your site really ends up. We try the http and https versions (and www and non-www for a main domain) and follow their redirects.
Hosting: the IP addresses your domain points at. When one of your servers has one of them, we put the site on that server. When the site is behind Cloudflare, this row says so: Cloudflare answers for your site and the real server stays hidden, so you pick it yourself in step 3.
SSL & certificate, Domain (registrar and expiry date), DNS & mail (where its email goes, SPF and DMARC) and IPv6.

A row we couldn't look up in time says "We couldn't tell in time"; press Look again to ask once more, and what you changed stays. Rows with a Change link can be corrected before you start.

Pages we suggest

Every site starts with its Home page. For a WooCommerce shop we also list the shop page, your biggest product category, a product and the checkout. The checkout only shows us an empty cart, so we check that it loads but not what search engines see there. When you add a site you can pick up to 5 pages, plus its login page and sitemap. In Checks & pages a site can have 7 pages in all, the login page and sitemap included. Remove a page with its ×, and add any other page with + Add page.

No shop or checkout page in the list? Shops with a classic (older) theme don't tell us where they are, and a site we couldn't see properly gets only its Home page, so add them with + Add page.

We also look for your login page and your sitemap, because a broken plugin often shows its PHP errors there first. That starts once the lookup is done; a moment later both rows under your pages show where we found them, switched on, and each becomes a page that is checked every 30 minutes for a Critical site, hourly for High, every 2 hours for Normal and every 4 hours for Low, so security plugins that watch the login page have no reason to block us, without the search engine and speed rules (both pages keep themselves out of search results and are small on purpose). Switch a row off to leave that page unchecked, or enter the address yourself when we couldn't find it. When your site didn't answer in time, press Try again.

What we can't see from outside

Step 3 asks which server the site is on and the domain's expiry date when its registry doesn't publish one (.nl, .de, .eu and .be don't); until you enter that date, the domain isn't watched. Leave out what you don't know and press Start watching; you can fill it in later. The first checks run as soon as you start watching.

On the Sites list, the tags under a site show where a detail came from: detected ones (wordpress, woocommerce, cloudflare) we found on its public pages and DNS, manual ones you set, and server ? means the site isn't linked to a server yet: we can't see it from outside, or its addresses aren't on one of your servers. Pick it in the site's settings.

For your developer

Look it up sends plain GET requests with the WPMooBot user agent, 12 seconds each and all within 16 seconds. The variants ask only for the first byte, and a variant stops when it redirects to an address we already ask for. When the typed address doesn't answer but a variant does, all four are asked again where the variant ends; when the home page ran out of time and a variant redirects to it, just the home page is asked once more:

GET /                    (and the http, https, www and non-www variants)
GET /wp-json/            (first 16 KB, for the namespaces)
GET /wp-json/wc/store/v1/products?per_page=1
GET /wp-json/wc/store/v1/products/categories?per_page=1&orderby=count&order=desc

Then the A and AAAA records of the host the site ends on, the MX and TXT records (and the _dmarc TXT record) of its domain, and the domain's RDAP record. The whole lookup ends within 20 seconds. WordPress means a generator meta tag, /wp-content/ or /wp-includes/ in the home page, or wp/v2 in the REST index; WooCommerce a wc/store namespace, or a product from the Store API (a slow server can miss the deadline on its REST index, which it builds whole). Shop and checkout come from wcSettings.storePages. A firewall that refuses these requests shows in the Website row: see When our checker is blocked.

Once the lookup is done, the login page and sitemap are looked for on the main address with as few requests as we can, so a slow server isn't flooded:

GET /robots.txt
GET /wp-login.php                                    (unless the site isn't WordPress)
GET /sitemap_index.xml, /sitemap.xml, /wp-sitemap.xml (only when robots.txt lists no sitemap)
GET /login, /inloggen, /admin, /beheer               (only when /wp-login.php shows no login form)

The sitemap is the first one robots.txt lists on the site's host, else the first usual address that answers a <urlset> or <sitemapindex>. The login page is the first address that shows WordPress's login form, unless it sends us to the home page. The login page and a sitemap found at a usual address are stored where their redirects end; a sitemap from robots.txt is stored as listed.

Something unclear on this page? Email [email protected]

Adding a site

What WP Moo finds

Pages we suggest

What we can't see from outside

For your developer

Cookies