Last updated: 30-Oct-2021
As I began a new project for a new client this week, I was tasked with tracking down the web host for the client. The client did not have a record of where its site was hosted. What seemed like a simple enough task actually turned out to be a real challenge. Discovering the web host was difficult because Cloudflare hosts the nameservers. Moreover, the DNS settings for the A-records pointed to Cloudflare.
Cloudflare provides CDN and DDoS mitigation services. As I understand it, Cloudflare does not provide web hosting, or at least not in the typical way for most WordPress websites. As a service, Cloudflare sits between users like you and me trying to visit a website, and the web server where that website sits. Cloudflare in the middle can make it a challenge to figure out where a website is actually hosted. That in turn can make it difficult to SFTP into it, or to get SSH access.
Fortunately, thanks to the Philly ‘burbs WordPress Meetup, I received helpful advice from Corey Salzano of Breakfast Company and Kevin Cristiano of Tadpole Collective. The following suggestions can also be applied to sites that do not use Cloudflare.
While I have yet to identify the web host (I am practically there; see below for One More Note), I am taking a few moments to share the steps and angles that I have tried thus far. Some of these ideas were my own. The better ideas came from Corey and Kevin. I’ll leave you to decide which is which.
I’ll pause to don a tip of the hat here to Sal Ferrarello who is a convincing evangelist for blogging about difficult tasks that we are likely to encounter again. Blogging how we dealt with the problem will help our future selves – and others too, no doubt. (And a belated thanks to Sal for contributing to the solutions listed below.)
Determining the Web Host WITHOUT Login Credentials
Even if we do not have access to the WordPress Dashboard on the site we are researching, there are a range of tools and techniques to help us discover the web host.
Explore the DNS Settings
- Use a tool like https://www.whatsmydns.net to see if the A-records or CNAME records shed any light.
- Use the same tool to see if the MX records point to the host. (They might point to Google or Microsoft as the email host.)
- By default, Cloudflare does not cache
ftp.domain.org, so a DNS lookup on that can reveal the IP, and from there the host. - With a IP lookup tool like that from What is My IP Address?, we can get more information about the host.
View the Page Source
- Most managed WordPress hosts have a few must-use plugins (MU plugins, in WordPress parlance), which sometimes output well-documented IDs and classes in HTML. In the browser, on the front end of the site, view the source code for a page. Use the “find” feature in the browser to look for those known IDs and classes.
- For example, Siteground use a caching plugin that output
sg-cachepressinto the HTML.
Tap into the WordPress API
- By default, the WordPress API leaves some user information open. Looking at the user details on a website might reveal clues as to the web host.
- Consider the screenshot below. Once we click on the headers tab, we can see x-powered-by displays WP Engine.
- Some managed WordPress hosts add themselves as users by default. For example, by default, WP Engine adds its user to WordPress sites on their servers. WP Engine is an admin user on my site. If we can find that user via the REST API, that will tell us who the host is. (To be candid, I am not sure why WP Engine is not showing up as a user. If you know, feel free to let me know in the comments below.)
- To access the above information on my site, use the link immediately below.
https://liamdempsey.com/wp-json/wp/v2/users- For your own site, you can add the following slug to the domain to get the user information.
/wp-json/wp/v2/usersOther Tools
- Sometimes, https://builtwith.com will reveal the details of the web host. Not always, but sometimes.
Determining the Web Host WITH WordPress Dashboard Access
If we can login to the WordPress Dashboard, we have a few more options.
Check the WordPress Menus
- Hosts often add an entire section to the WordPress Dashboard for their own systems. My experience is primarily with WP Engine, Kinsta, and Nexcess. All three of these solid managed WordPress hosts inject themselves into the main WordPress menu on the left side. I expect that other hosts take a similar approach.
- Hosts often include links in the menu along the top of the WordPress Dashboard. These same links are often visible on the front end of the site when we are logged into the site.
Explore the Users
- As set out above, web hosts often include a user for themselves.
- Alternatively, we might find a name or email address that can point us in the direction of whoever made or previously managed the site. That can be a good place to ask about the web hosting.
Check the Plugins
- Again, as previously shared, some web hosts install one or more MU plugins on their sites. Those MU plugins are often include the name of the web host. See the above screenshot of a list of must-use plugins running on this site.
- There is an older plugin in the WordPress Plugin Repository called Server IP & Memory Usage Display. The plugin should reveal the actual server IP address – and not the Cloudflare records.
The WordPress Administration Email
- With the WordPress Dashboard, check the Administration Email Address (Dashboard > Settings > General). This is not likely to reveal the web host, but it may let us know who built or managed the site. Perhaps that person knows.
One More Note
Once a web host is identified, it can still be a challenge to get access to a customer portal or dashboard – or SFTP and SSH access. Web hosting resellers, especially the really smaller ones with only a few sites, can prove a challenge when trying to locate and regain access.
I expect that there are other ways to find out who exactly is hosting the WordPress website. Feel free to share your own tips and ideas in the comments below.