Hey there, I’d start with this query.

services.http.response.body: /.*wp-(admin|includes|content|login)\/.*/ and labels="wordpress"

It’s a bit broad, but you can narrow down from there.

Alternatively, if you can't use regex in your queries, you can try using the wordpress label, content in services.http.response.html_title like “GiveWP”, as well as the WP Automatic software fingerprint (services.software.product=`WP Automatic`).

Additionally, some WP plugin fingerprints other than WP Automatic exist as labels and you could look for those (for example, labels=`yoast-seo`).

Hope this helps!

Thank you