WordPress Theme & Plugin Detector

What the WordPress Theme & Plugin Detector checks

WordPress sites load their design and features from predictable folders: the theme from /wp-content/themes/<name>/ and plugins from /wp-content/plugins/<name>/. Asset URLs often carry a ver= parameter with the version of the theme, plugin or WordPress core that added them.

This detector reads the HTML of the URL you enter and works out whether the site runs WordPress, which theme it uses and which plugins the page loads, with versions where the asset URLs expose them. It compares those versions with the WordPress.org plugin directory, the supported WordPress release lines and the known-vulnerability pages we have published, and marks anything that looks outdated or affected. It only sees what the page itself loads: plugins that work on the server, inactive plugins and plugins used only on other pages are invisible, and many sites hide or strip version numbers.

Why it matters

Security researchers consistently report that most WordPress vulnerabilities are found in plugins and themes rather than in WordPress core. A plugin that has not been updated for months may carry a publicly documented flaw, and automated attack tools look for exactly the version numbers this detector reads.

For site owners, the result is an outside view of what you expose: the plugin list and versions anyone can read from your pages. For everyone else, it answers the common question of which theme or plugin a site is built with. See our guide to outdated software.

How to fix common problems

Update WordPress core, themes and plugins from Dashboard → Updates, after a backup and preferably on a staging copy first. Turn on automatic updates for plugins you trust, at least for security releases. Delete plugins and themes you no longer use instead of only deactivating them, because inactive code on disk can still be attacked directly.

If a plugin has not been updated by its author for a long time, or has been closed in the WordPress.org directory, replace it with a maintained alternative. When a version is flagged as affected by a published vulnerability, open the matching page to find the fixed version, update first, then review your logs for signs of misuse.

Version numbers in asset URLs exist mainly for cache busting. Hiding them does not fix anything, so keep updating rather than relying on obscurity. Front-end libraries such as jQuery matter too; see vulnerable JavaScript libraries. The full PerfoMetrix audit adds server software versions, known-vulnerability checks and 170+ other checks.

Questions

Why is a plugin I use not listed?

The detector only sees plugins that load CSS, JavaScript or images on the page you entered. Plugins that work on the server, such as backup, security or caching plugins, inactive plugins and plugins used only on other pages leave no trace in that HTML.

Why is no version shown?

Versions come from the ver= parameter on asset URLs. Many sites and optimization plugins remove or replace it, and some plugins use build stamps instead of version numbers. Without a version, the tool cannot judge whether a plugin is outdated.

Can it detect a custom or child theme?

It shows the folder name the theme is loaded from. Custom and child themes appear under their own folder names, which may not match any theme sold or listed publicly.

Does a red result mean my site was hacked?

No. It means the version your pages expose is outdated or falls in a range with a published vulnerability. Update it, then check your logs if you want to know whether anyone tried to exploit it.