What WordPress Theme Detector does
WordPress Theme Detector fetches one public page and looks for generator metadata, wp-content theme and plugin paths, and WordPress core paths. It deduplicates exposed theme and plugin slugs, then uses the first theme slug to request one standard same-origin style.css file.
Detection depends on what the site publicly exposes. Optimization plugins, custom builds, renamed directories, bundled assets, proxies, child themes, and blocked stylesheets can hide or change the evidence. A path or declared version is not proof of the active code, ownership, security state, license, or vulnerability status.
How to use WordPress Theme Detector
- Enter the full public URL of the WordPress site or page to inspect.
- Select Detect theme to fetch the HTML and analyze public asset clues.
- Review the WordPress evidence, theme header fields, and bounded plugin slug list.
- Confirm important theme or version details in the site's administration or source repository when authorized.
Important details
Evidence comes from exposed paths and metadata
The report can cite a WordPress generator tag, wp-content theme or plugin paths, and WordPress core paths. A positive clue is evidence; the absence of clues is not proof that WordPress is not used.
Only one theme stylesheet is inspected
If a theme slug is found, the tool requests its conventional same-origin style.css path and reads bounded Theme Name, Version, Author, and Theme URI headers when present.
Plugin slugs are not a security scan
Up to a bounded list of path names can be reported from HTML. They do not prove a plugin is active, reveal its installed code, or establish whether any version is vulnerable.
Practical uses
- Identify public theme clues before planning an authorized redesign.
- Document exposed WordPress paths during a site technology inventory.
- Compare theme metadata before and after a migration or asset-bundling change.
Privacy and limitations
The URL is sent to PagesTools, which fetches the public page and at most one safe same-origin theme stylesheet. The site can log those server requests, and the JSON response uses no-store cache headers.
Hidden, renamed, bundled, proxied, or blocked assets can prevent detection. Results do not prove active theme or plugin versions, security status, ownership, licensing, or the absence of WordPress when no signal is found.