WordPress Theme and Plugin Detector

You found a site with a layout you like, or a feature you have been trying to build for a week. Paste its address in and this will tell you what it is running.

How to read what comes back

The result has three parts, and each tells you something different.

The green bar at the top

Says whether the site runs WordPress at all, and sometimes which version.

If a version number appears, that site is publishing it openly in its page code. Not a hole by itself, but it does hand anyone scanning for old installs a convenient filter. Worth noticing on your own site.

The theme

You get the real name, version and author. Not the folder name, the proper name from the theme’s own file. So you see GeneratePress by Tom Usborne rather than just generatepress, which means you can actually go and find it.

Sometimes there is a Child of line. That matters. It means the site is running a small custom theme layered on top of a bigger one. The parent is the theme you would buy or download. The child is the owner’s own work, and it is not something you can get.

So if you see “Hello Elementor Child, child of hello-elementor”, the theme to go looking for is Hello Elementor. The rest is their custom code.

The plugin list

Every plugin that is loading a file on the page you checked. The proper name where we recognise it, plus the folder name underneath so you can search for it.

Read this list as “at least these”, never as the full picture. The next section explains why.

Why the plugin list is always shorter than reality

This is the single most important thing to understand, and every detector shares the limitation, including the paid ones.

A plugin only becomes visible if it loads a stylesheet or a script on the exact page being checked. Many never do.

Backup plugins, SMTP plugins, most security plugins and nearly all SEO plugins work quietly in the background or only inside the admin area. They put nothing into the public page, so nothing can see them from outside.

A site showing four plugins is probably running fifteen. That is normal and not a fault in the tool.

Getting a fuller picture

Check more than one page. A checkout page loads different plugins from a blog post. A contact page reveals the form plugin. Running three or four pages of the same site gives you a much better list than running the homepage alone.

Two things that hide almost everything

Caching plugins that merge files. WP Rocket, LiteSpeed Cache and similar tools combine dozens of scripts into one file with a generic name. All the original folder names vanish in the process. A site doing this heavily may show nothing at all.

A renamed content folder. A few security setups move wp-content somewhere else. This tool tries to follow that, but a site doing it properly can stay quiet.

So if a site you know for certain is WordPress comes back empty, one of those two is nearly always the reason.

How it knows any of this

Nothing clever, and nothing private. WordPress loads its files from predictable folders, and those addresses sit in the page source that every visitor already receives.

A theme gives itself away like this:

<link rel="stylesheet" href="https://example.com/wp-content/themes/generatepress/style.css">

And a plugin like this:

<script src="https://example.com/wp-content/plugins/contact-form-7/includes/js/index.js"></script>

Once the theme folder is known, the tool fetches that theme’s style.css and reads the header block at the top, which is where WordPress requires the real name, version and author to be declared. That is how you get a proper name instead of a folder name.

You can see all of this yourself without any tool. Right click any page, choose View Page Source, and search for wp-content. The tool just does the reading and tidies it up.

Run your own site through it

Do this once. It shows you what you are broadcasting to anyone who looks, and it usually turns up something worth fixing.

If your WordPress version is showing

Your site is announcing it in a meta tag. Anyone scanning for sites running a version with a known problem can find yours by searching for exactly that. Most security plugins can turn it off, or one line in your theme’s functions.php does it:

remove_action( 'wp_head', 'wp_generator' );

Worth being honest about this one: hiding the version is a small measure, not a real defence. Keeping WordPress updated is the actual answer. But it costs nothing.

If you see a plugin you removed months ago

This is the genuinely useful find, and it catches people out often.

Deactivating a plugin does not delete it. The folder stays on your server, the files stay reachable, and they stop receiving security updates. An abandoned plugin folder sitting on a live site is exactly the kind of thing that gets exploited a year later.

Go to Plugins, and for anything you are not using, click Delete rather than just Deactivate.

What to do with what you find

The usual reason people run this is “how did they build that bit”. A few honest notes on that.

Finding the plugin gets you most of the way, but rarely all of it. Plenty of sites take a plugin and style it heavily with custom CSS, so installing the same plugin gives you something that works the same but looks nothing alike.

If the site is running a child theme, the part you admire may well be in that child theme rather than in any plugin at all. Nothing will give you that, because it is code somebody wrote for that site alone.

And copying a whole design is both bad practice and legally risky. Using the same tools is completely normal. Copying a layout pixel for pixel is not.

Questions people ask

Does this scan or hack the site?

No. It requests the page once, exactly as your browser does when you visit, and reads the HTML that comes back. It does not log in, does not probe for hidden files, and does not touch anything a normal visitor could not reach.

Will the site owner know?

It appears in their traffic logs as one page view, the same as any visitor. Nothing marks it as unusual.

Is it legal to check someone else’s site?

You are reading the page they publish to the world, which is what every browser does. No private data is involved at any point.

Nothing came back at all

Either it is not WordPress, or the site is behind something that blocks automated requests, which Cloudflare will sometimes do. Sites built on Wix, Squarespace and Shopify will always come back as not WordPress, because they are not.

Can I see exact plugin versions?

Not here, and that is deliberate. Version numbers do sometimes leak in file addresses, but publishing a searchable list of sites running an outdated version of a specific plugin is a shopping list for anyone looking for a way in.

Theme versions are different, because a theme publishes its own version in a file meant to be read.

It named a plugin I have never heard of

Where the folder name is not one we recognise, the tool tidies it into readable words. That is a guess at the name, not a lookup. Search the folder name shown underneath, which is exact, and you will find the real plugin.