We scored 2,080 real WordPress sites

Zero of the 2,080 verified WordPress sites — a real cross-section of the open web, not a curated showcase — have a /.well-known/webmcp.json manifest yet. That's expected this early; it's still the whole reason this index exists.

The sharpest finding is bot access. Only 2% of sites checked explicitly welcome AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, anthropic-ai) in robots.txt. 17% actively block at least one of them. The remaining 81% say nothing either way — silence that Site Passport's methodology scores lower than an explicit allow, deliberately, because it's indistinguishable from an oversight.

llms.txt adoption sits at 29% — real, but still a minority.

Schema.org markup is the one check most sites pass (84%) — it's old, well-established SEO practice. AI-crawler awareness is new, and at this scale, the numbers make that gap unambiguous rather than anecdotal.

25,000 candidates were drawn from the Tranco top 25,000 — a research-grade domain ranking built specifically to resist manipulation and gaming, used widely in academic security and web research. This is a real cross-section of the popular web, not a list curated to make WordPress look good or bad.

Reputation isn't proof, so every candidate was checked live for a genuine WordPress signature: a working /wp-json/ REST API root, a generator meta tag naming WordPress, or a same-origin wp-content/wp-includes asset reference on that exact host. A shared media CDN on a different subdomain doesn't count as evidence for the domain it's hosted under — a bug the original pilot batch caught and fixed, carried forward here.

2,080 of 25,000 candidates verified — an 8.3% hit rate. The rest are either not running WordPress, or don't expose a detectable signature from the outside — both are reported as "not confirmed," never guessed. Every verified site was then scored with the exact same production methodology (sp_run_checks()) that powers every live scan and directory listing on this site — one implementation, no separate "report mode" logic to drift out of sync.

This supersedes the original 22-site pilot batch. Site Passport isn't on WordPress.org yet, so there's no live install base to auto-populate the directory from — this report is the cold-start data point instead. Expect periodic re-runs as adoption (hopefully) changes.