CoreScanWP v1.4

See what powers any WordPress site.

A free WordPress detector that finds the core version, active theme, every installed plugin, and the hosting provider behind any public site. Results in seconds.

Everything you can learn about a WordPress site

CoreScanWP runs four detectors in parallel, then cross-checks the findings. You get the WordPress core version, the active theme, a full plugin list, and a hosting picture in one pass.

WordPress detection

Confirms a WordPress installation by weighing eight or more independent signals: the generator meta tag, /wp-content/ paths in HTML, the api.w.org link element, the wp-json REST API, response headers like X-Powered-By and Link, and the RSS feed. Returns a confidence score, not a binary.

  • Reads the exact core version from the generator, RSS feed, or readme
  • Lists every signal that contributed to the verdict
  • Works on hardened sites that hide the generator meta tag

Active theme

Identifies the theme by reading /wp-content/themes/<slug>/ references in the HTML, then fetching the theme's style.css to confirm its real name, version, author, and URI. Works on custom themes (TechCrunch's tc-24, WordPress.org's wporg-news-2021) as well as off-the-shelf ones.

  • Pulls human-readable name, version, and author
  • Flags the active theme distinctly from inactive ones
  • Marks themes as confirmed when style.css is readable

Installed plugins

Catches plugins that ship front-end assets, plugins active only on inner pages, and plugins with no front-end footprint at all. Each finding is then verified by reading the plugin's readme.txt for its real name and version.

  • Crawls inner pages to catch checkout, form, and embed plugins
  • Probes ~230 popular plugin slugs for active enumeration
  • Calibration step prevents false positives on hardened servers

Hosting & CDN

Detects the host across three independent signals: response headers (WordPress VIP, Kinsta, WP Engine, Cloudflare, Fastly, Akamai), reverse DNS patterns on the resolved IP, and the network owner via ASN lookup. When a site sits behind a CDN, the scanner says so and labels the origin as hidden.

  • Identifies managed WordPress hosts and CDNs by header
  • Resolves IP, reverse DNS, ASN, and country
  • Flags when the origin server is hidden behind an edge

How the detection actually works

CoreScanWP is a passive scan: it only reads what the site already serves to any visitor. No login, no rate-limit games, no probing for vulnerabilities.

  1. 1

    Read what the site already serves publicly

    The scanner fetches the homepage, response headers, /wp-json/, /feed/, and /readme.html. From those it extracts WordPress fingerprints, the core version, the theme slug, plugin asset references, and hosting tells from headers.

  2. 2

    Crawl a handful of inner pages

    Many plugins only load assets on specific pages: a form on /contact, checkout on a product page, an embed on a single post. CoreScanWP extracts internal links and crawls up to five inner pages so those plugins surface too.

  3. 3

    Probe known plugin slugs (with a false-positive guard)

    Deep scan probes ~230 popular plugin readme files. Before probing, the scanner sends two fake slugs to detect catch-all servers. If a non-existent plugin returns a 403 or a generic 200, those responses are treated as noise. Real plugins are confirmed; phantoms are filtered out.

8+

Independent WordPress signals weighed per scan

230

Popular plugins probed in deep scan mode

3

Hosting detection signals: headers, PTR, ASN

0

Logins, exploits, or vulnerability probes

Common questions

Everything people ask before scanning their first site. Skip to a specific question or read straight through.

How can I tell if a website is built with WordPress?

Type the URL into CoreScanWP. It inspects the HTML, response headers, REST API, and RSS feed for WordPress fingerprints and shows every signal it found, so you can verify the conclusion yourself. Most WordPress sites are detected with high confidence in under two seconds.

How do I find what theme a WordPress site is using?

After a scan, the Themes section shows the active theme with its slug, real name, version, and author. CoreScanWP reads the theme slug from /wp-content/themes/ references in the HTML and confirms it by fetching the theme's style.css file.

Can CoreScanWP find every plugin on a site?

It finds plugins visible in the HTML of the homepage and crawled inner pages, plus any of ~230 popular plugins it can probe directly. Custom or premium plugins not in the wordlist that ship no front-end assets can still stay hidden. That limitation exists for any external scanner.

Does it work on sites behind Cloudflare or another CDN?

Yes for WordPress, theme, and plugin detection. Those signals live in the HTML and pass through CDNs unchanged. For hosting, CoreScanWP identifies the CDN (Cloudflare, Fastly, Akamai, CloudFront) and flags that the origin server is hidden behind it.

What is the difference between a regular and a deep scan?

Without deep scan, CoreScanWP only reads the homepage HTML, which is fast but limited. Deep scan crawls a few inner pages and probes ~230 known plugin readme files, finding far more plugins for a few extra seconds of scan time.

Will the site I am scanning know I scanned it?

They will see ordinary page visits in their server logs, identical to any browser visitor. CoreScanWP does not log in, exploit anything, or trigger security alerts. It only reads public resources.

How accurate is the WordPress version it reports?

Very, when the site exposes a generator meta tag. When that is hidden, accuracy depends on the RSS feed or readme.html. CoreScanWP always shows the source of the version so you can judge the confidence yourself.

Why doesn't a plugin I know is installed show up?

Two common reasons: the plugin ships no front-end assets and isn't in the wordlist, or the host blocks all /wp-content/plugins/ file access. The empty plugin list does not prove a site has none, only that none were detectable from outside.