Can a hacker determine what version of WordPress and PHP a site is using? Assume this info is not available by View Source.
Most PHP-enabled web servers will display the PHP version in the Server response header. For example, my development machine currently shows this with all of its requests:
Server: Apache/2.4.38 (Win64) PHP/7.3.2
There are configuration settings to turn off displaying the PHP version, and it really is quite trivial to lie about anything and everything in HTTP response headers.
Additionally, there are several ways to get the version of Wordpress installed, the easiest way being to to go to /readme.html on the site.
The RSS/ATOM feeds will also often include the Wordpress version number.
Though you said we should assume that the information isn't available by viewing the page's source, it is often available in a meta tag, depending on the theme.
Links to some resources will have cache busting parameters attached to them, with the cache busting string sometimes being the version of Wordpress that is installed.
And, if you have the time and determination, you can fingerprint the common files that are found in most Wordpress distributions. If a file changes in a specific version, you can look for those changes.
A clever developer can cause each of these to lie, of course, and can mutate the static files in a way that makes fingerprinting them a futile endeavor, but most people follow the default behavior of their PHP version and Wordpress software, making it trivial to identify versions.
All of this underscores the importance of keeping your software up to date to prevent known vulnerabilities from being exploited.
As far as whether or not a hacker can identify the version of PHP and Wordpress... Well, anyone can, so I suppose a hacker can, as well.
There are different tools available on the web you can use freely to identify information about your website like pentest-tools.com
As hackers equipped with more strong tools or scripts, they can identify it easily. But yes you can make your website more secure by just testing your website on these freely available tools and then
- modify your header setting
- close unnecessary ports
- don't allow ssh access
- you can patch against the shown vulnerabilities in scans