WordPress "scripts" pattern /wp-content matches inside Google Tag Manager, flagging every GTM site

[rgrieselhuber]

src/technologies/w.json:

"WordPress": {
  "scripts": ["/wp-content"],
  "implies": ["PHP", "MySQL"]
}

/wp-content is an unanchored 11-character substring matched against JavaScript source. Google Tag Manager's bundle contains that literal string, so any site loading GTM is detected as WordPress, and the implies chain turns one weak match into three false detections: WordPress, PHP, MySQL.

Reproduction

Confirmed by locating which script body contains the string, on two unrelated sites:

site	actual stack	/wp-content found in
peec.ai	Framer	googletagmanager.com/gtm.js (5 scripts)
rakuten.co.jp	Apache / Java-era	googletagmanager.com/gtag/js (16 scripts)

Neither runs WordPress.

First-party tagging makes it worse: john lewis proxies GTM through their own domain at /dblclick/gtag/js and /googleads/, so the offending bundle is served same-origin and any host-based mitigation misses it.

Note

HTTPArchive/wappalyzer's copy of the WordPress fingerprint has no scripts field at all, so this is specific to this dataset.

Suggestions

• Drop the scripts rule. scriptSrc: /wp-(?:content|includes)/ already matches the URL rather than arbitrary script text, and meta[generator], the link rel="https://api.w.org/" header and the wp-json REST route are all far more specific.
• If it is kept, anchor it so it cannot match a bare mention, and consider \;confidence: well below 100 given the implies chain amplifies it.

Found while building a matcher over this dataset; happy to send a PR if the direction is agreed.