Free tool
WordPress theme & plugin detector
Enter a website address to find out whether it runs WordPress, which theme it uses (and the parent theme, if it’s a child theme), and which plugins load on its homepage.
How to read the results
- WordPress or not
- We look for the signs WordPress leaves in a page: the generator tag, files under /wp-content/ and /wp-includes/, and the link to its REST API. Some sites hide these, so ‘not detected’ isn’t proof.
- WordPress version
- Shown only when the site gives it away, usually in the generator tag. Many sites remove it, which is sensible.
- Theme
- Read from the header of the theme’s style.css file: its name, version, author and description. If it’s a child theme, the parent theme is listed too.
- Plugins
- Plugins that load a stylesheet or script on the homepage, each linked to its page in the WordPress.org plugin directory. Premium plugins aren’t in the directory, so they have no link.
Frequently asked questions
Why isn’t every plugin listed?
Only plugins that load files on the homepage can be detected. Plugins that work behind the scenes, such as backup or security plugins, or that only run on certain pages leave no trace there. Optimisation plugins that combine files can hide plugin names too.
Can it see a theme that’s been renamed?
It reports what the theme’s style.css says. If a developer renamed the theme’s folder or edited its header, that’s what you’ll see. A custom-built theme shows its own name rather than one you can download.
What is a child theme?
A child theme sits on top of another theme, its parent, and changes only parts of it, so the parent can be updated without losing those changes. When the detector spots one, it shows both.
Why does it say a site isn’t WordPress when I know it is?
Some sites strip out WordPress’s tell-tale paths, serve their files from another domain or block automated visits. In those cases the detector can’t see enough to be sure.
Does the detector log in or scan for weaknesses?
No. It loads the homepage once, the way a browser does, plus the theme’s public style.css file. It never logs in, submits forms or probes for vulnerabilities.