WordPress Plugin Detector

A WordPress plugin detector reads a public page and lists the plugins loading on it. You paste a site address and get each plugin's folder slug, its published name where one is known, the version, roughly how many sites run it, and the signals that prove it was there. It answers the question people ask about a site they admire: which plugin is doing that. Themes are a separate question with separate evidence, so they are a separate tool - the [WordPress theme detector](/tools/theme-detector) reads the same page and reports what is rendering it.

The detection works because a plugin that does anything on the front end has to load something from its own folder. WordPress serves those files from /wp-content/plugins/<slug>/, so a stylesheet, a script, an inline handle or an image path names the plugin that owns it. Some plugins also announce themselves more plainly: a body class, a REST namespace, a meta tag, a generator comment, a cookie. Each of those is a fact about the page rather than an inference, and when the plugin catalogue can be consulted the slug is matched to a published entry so the list carries real names, current versions and install counts instead of bare folders.

The list is a floor, not a total, and this is the part most tools leave out. A plugin that only runs in wp-admin loads nothing for a visitor. A plugin that only fires on a checkout page is invisible from the homepage. A caching or optimisation plugin that merges every script into one combined file erases the folder names of everything it merged, including itself. A host that proxies assets through a CDN path can hide all of them at once. So the report says how many folders matched a catalogue entry and how many are folder names only, and it lists what could not be checked above the results rather than leaving an empty list to be misread as an empty site. Scanning an interior page - a post, a product, a contact form - reliably shows more than a homepage does.

What comes back is a report you can hand to someone else. The headline says how many plugins are on that page, or plainly that none were visible, or that the site is not WordPress at all - three different answers that a single number would blur. The list sorts by install count, so the recognisable names come first and the unnamed folders sit at the bottom where they belong. Underneath, What this is based on lists the literal evidence: the asset path, the REST route, the body class. Copy the whole thing as text for an audit or a proposal. The scan runs on our server, because a browser cannot fetch another site directly; the address is not stored, and the site sees one ordinary request in its logs. It is free, no signup.