WordPress Theme and Plugin Detector

You found a site with a layout you like, or a feature you have been trying to build for a week, and you want to know what it is running. Paste the address below and this will tell you the theme and the plugins it can see.

How it knows

Nothing clever, and nothing private. WordPress loads its stylesheets and scripts from predictable folders, and those paths sit in the page source that every visitor already receives.

A theme gives itself away like this:

<link rel="stylesheet" href="https://example.com/wp-content/themes/generatepress/style.css">

And a plugin like this:

<script src="https://example.com/wp-content/plugins/contact-form-7/includes/js/index.js"></script>

Once the theme folder is known, this tool fetches that theme’s style.css and reads the header block at the top, which is where WordPress requires the real name, version and author to live. That is why the results show GeneratePress by Tom Usborne rather than just the folder name.

Why some plugins never show up

This is the honest limitation, and every detector shares it.

A plugin is only visible if it loads a file on the exact page being checked. Plenty never do. A backup plugin, an SMTP plugin, a security plugin and most SEO plugins do their work quietly in the background or in the admin area, and put nothing in the page source.

So a site showing four plugins here is probably running fifteen. Treat the list as “at least these”, never as the full picture.

Two things that hide results

• Caching and file merging. WP Rocket, LiteSpeed Cache and similar tools combine many scripts into one file with a generic name. The original folder names disappear along the way.
• A renamed content folder. A few security setups move wp-content somewhere else. This tool tries to follow that, but a site doing it well can stay quiet.

If a site you know is WordPress comes back with nothing, one of those two is usually why.

Checking your own site

Run your own address through it once. It is a quick way to see what you are broadcasting.

If the result includes a WordPress version number, your site is publishing it in a meta tag. That is not a hole on its own, but it does hand anyone scanning for old installs a free filter. Most security plugins can remove it, and so can one line in your theme’s functions.php:

remove_action( 'wp_head', 'wp_generator' );

Seeing your plugin list is more useful than it first looks. If a plugin you removed months ago still shows here, its folder is still on the server and still reachable. Deactivating a plugin does not delete it, and an abandoned plugin folder is exactly the kind of thing that gets exploited later. Delete, do not just deactivate.

Common questions

Does this log in or scan anything?

No. It requests the page once, exactly as a browser would, and reads the HTML that comes back. There is no login, no probing for files, and no attempt to reach anything a normal visitor could not.

Is it legal to check someone else’s site?

You are reading the page they publicly serve, which is the same thing your browser does every time you visit. Nothing here touches private data.

It says the theme is a child theme. What does that mean?

The site is using a small theme that sits on top of a bigger one, so custom changes survive updates to the parent. When the tool can see it, the parent is listed as “Child of”. The parent is the theme you would buy or download; the child is the site owner’s own work.

Nothing came back at all

Either it is not WordPress, or the site is behind something that blocks automated requests, which Cloudflare will sometimes do. Sites built on Wix, Squarespace and Shopify will always come back as not WordPress, because they are not.

Can I see the exact plugin versions?

Not reliably, and deliberately so. Version numbers do sometimes appear in asset URLs, but publishing a list of sites running outdated versions of specific plugins is a shopping list for anyone looking for a way in. Theme versions come from a file the theme itself publishes, which is different.