How to Detect a WordPress Theme and Its Plugins

2 min read by Mohammad Shoeb

How to Detect a WordPress Theme and Its Plugins

Every WordPress site leaves clues in its public HTML about how it was built. The theme name, active plugins, and even version numbers are often sitting right there in the source, waiting to be read. Here is how to find those fingerprints and what they can and cannot tell you.

The fingerprints to look for

WordPress loads most of its assets from predictable paths, and those paths name the theme and plugins directly:

  • Theme path: /wp-content/themes/<name>/ in any stylesheet or script URL names the active theme. So /wp-content/themes/astra/style.css means the site runs Astra.
  • Plugin paths: /wp-content/plugins/<name>/ reveals each plugin loading assets on the front end. Count the unique names and you have the plugin list.
  • Version strings: A ?ver= query appended to a file, like style.css?ver=4.6.2, exposes the theme or plugin version. Handy for spotting outdated, vulnerable installs.
  • Generator meta tag: <meta name="generator" content="WordPress 6.5" /> confirms WordPress and often the core version.

Beyond paths, certain class names and prefixes act as signatures. et_pb_ marks the Divi builder, elementor marks Elementor, woocommerce body classes mean the store plugin is active, and wp-block- classes signal the block editor is in use.

How to detect the theme and plugins

The WordPress Theme & Plugin Detector inspects HTML you paste. It does not fetch URLs, so you grab the source yourself first, then paste it in.

  1. Open the WordPress site in your browser.
  2. View the page source (right click, then “View page source”, or Ctrl+U).
  3. Select all and copy the full HTML.
  4. Paste it into the WordPress Theme & Plugin Detector and read the parsed results.

The tool scans for the paths and signatures above, lists the theme and every detectable plugin, and pulls any version numbers it finds in ?ver= strings and the generator tag. Because everything runs in your browser, the HTML you paste never leaves your device.

What you can and cannot detect

This method only sees what the front end ships. That has real limits worth understanding:

  • Front-end plugins are visible. Anything that loads CSS or JS on the public page, like sliders, forms, SEO output, or page builders, shows up.
  • Admin-only plugins are invisible. Backup tools, security scanners, and editor add-ons that never touch the front end leave no trace in the HTML.
  • Renamed wp-content breaks path detection. Some sites move or rename the wp-content folder, which hides the standard theme and plugin paths.
  • CDNs and optimization can obscure things. Combined or minified asset bundles, asset rewriting, and aggressive caching plugins sometimes strip the telltale paths and version strings.

Treat the output as strong evidence, not a guaranteed full inventory. A clean result does not always mean a plugin is absent, just that it left no front-end fingerprint.

Read the source, and most WordPress sites tell you exactly how they were built.

WordPressHow-to

← All posts