What plugins is this WordPress site using?
Paste any URL and we fingerprint the active plugins behind it, reading page assets, REST API routes, and HTML hints, then flag any that carry known security vulnerabilities. Free, no signup.
What the scan detects
Plugin fingerprint
Surfaces active plugins from page assets, REST routes, and HTML hints, including plugins that don't announce themselves in the markup.
Known-CVE flags
Cross-references detected plugins against a public vulnerability database, so an outdated plugin with a known exploit gets flagged.
Theme + hosting too
The same scan also identifies the active theme, the hosting provider, the stack, and the WordPress core version behind the site.
WordPress plugin detector FAQ
How do I tell what plugins a WordPress site is using?
Paste the site's URL above and run the scan. We read the page's assets, REST API routes, sitemap, and HTML fingerprints, then match them against the most common WordPress plugins to list what's active. You can also open the source yourself and look for /wp-content/plugins/ paths, but a scan surfaces plugins that leave subtler traces than a raw source view.
Can it detect plugins that don't show up in the page source?
Often, yes. Beyond obvious /wp-content/plugins/ asset paths, we also check /wp-json/ REST API namespaces, sitemap comments, and asset-probe requests, so a plugin that doesn't advertise itself in the raw HTML can still be caught across those other signals. The trade-off is that a single-page scan can't see everything.
Will it find inactive, admin-only, or custom plugins?
Usually not. The scan only sees what a public page exposes, so plugins that are deactivated, run only in the WordPress admin (security, backup, or back-end SEO tools), or are custom-built with no frontend footprint typically won't appear. Those generally can't be identified without logging into the dashboard.
Is the plugin detector free?
Yes. The plugin scan is free and needs no signup. The same scan also identifies the theme, hosting provider, and WordPress core version, and flags any detected plugins that carry known security vulnerabilities.