How to use WordPress Plugin Detector
- Enter the public HTTP or HTTPS URL of the website or page you want to check. Avoid URLs containing private tokens.
- Run the check and wait for the report. Use Cancel if you need to stop waiting; cancellation does not guarantee that an already-started server request stops.
- Read the evidence behind each reported plugin signal. Distinguish an observed path or asset from an assumed installed component.
- If you own the site, confirm the result in WordPress Plugins, Site Health, or WP-CLI. An external scan is not a substitute for that inventory.
Worked example
Illustrative evidence only. This example is not a live scan or a claim that a particular website was tested.
Input
A public page contains an asset path: /wp-content/plugins/example-plugin/assets/site.css
Output
Visible plugin-related path: example-plugin Evidence: public page asset URL
A plugin directory name in a public asset URL can provide a useful clue. It may be stale or rewritten, and it does not establish the installed version, activation status, or security of that plugin.
How public plugin detection works
The PHP scanner requests public resources, checks redirect destinations, and looks for supported WordPress fingerprints in the response. Recognizable plugin asset paths and other public signals can support a finding. The report separates observations from recommendations.
The scanner does not sign in to the target, run code inside WordPress, or access its database. A JavaScript-rendered or authenticated view may expose different information from the response received by the scanner.
Read an incomplete or empty report
A missing signal means that the supported checks did not observe it. Plugins that only run in the admin area or on other pages may leave no trace on the tested page. Caching, asset optimization, CDNs, and renamed paths can also obscure signals.
A blocked request, timeout, or partial response limits the evidence available. Try the relevant public page and review the reported limitations. Results can be reused from the scanner cache for up to 15 minutes; an immediate repeat may not represent a fresh fetch.
Limits and verification
Private networks, embedded URL credentials, and non-web protocols are rejected. Some websites block automated requests. Detection is not a vulnerability assessment, and a plugin name is not proof of a safe or unsafe version.
For a site you administer, compare the report with the Plugins screen or wp plugin list. Do not install, remove, or update a plugin solely because of an external fingerprint.
Frequently asked questions
Can this detect every WordPress plugin?
No. It can identify only supported signals visible in the public resources it checks. Admin-only plugins and concealed or rewritten assets may not be detectable.
Why does the result differ from my Plugins screen?
The report describes public evidence, while the dashboard describes the actual installation. Cached assets, inactive files, or plugins not used on the tested page can cause differences.
Is the website URL processed on my device?
No. The URL is submitted to FyrePress, and its server performs the public check. Scanner results can be reused from a cache for up to 15 minutes.