WordPress Plugin Checker
Find out which WordPress plugins - and versions - any site is running, across 200+ recognised plugins, plus any known vulnerabilities. Free online tool, no installation, instant results in your browser.
- Free
- No signup required
- Read-only scan
- 200+ plugins
Used by developers, agencies, and site owners to audit plugin stacks
200+ Plugin Detection
Enumerate the plugins a site runs using asset paths, readme.txt files, and script fingerprints.
- wp-content/plugins paths
- readme.txt enumeration
- Script & style fingerprints
- Covers ~70% of installs
Version Detection
Where exposed, we extract the exact plugin version so vulnerability matching is precise.
- readme.txt stable tags
- Asset ?ver= fingerprinting
- 96% version accuracy
- Outdated plugin flag
Plugin Vulnerabilities
Detected plugins are matched against known vulnerabilities (plugins are the most common way into a WordPress site) and the full report is included.
- 100K+ CVE matching
- CVSS 3.1 severity
- Core & theme included
- One scan, full picture
Detects 200+ Popular WordPress Plugins
Covering the large majority of WordPress installations worldwide
Frequently Asked Questions
How do I find out what plugins a WordPress site is using?
Enter the site URL above and run the scan. ScanTower enumerates plugins from wp-content/plugins asset paths, readme.txt files, and script/style fingerprints, then lists the detected plugins and versions.
How many plugins can it detect?
The scanner recognises 200+ of the most common WordPress plugins - covering the large majority of real-world installs - including WooCommerce, Elementor, Yoast SEO, Contact Form 7, ACF, Jetpack, and many more.
Does it detect plugin versions?
Where the version is exposed via readme.txt stable tags or asset query strings, we report it and match it against known vulnerabilities for that exact version.
Can it tell me if a plugin is vulnerable?
Yes. Detected plugins are cross-referenced against 100K+ CVEs with CVSS severity scoring, so you can see which plugins on the site have known security issues.
Do I get more than just the plugin list?
Every check runs the full WordPress scan, so along with the plugins you also get the WordPress core version, the active theme, known CVEs, and common security misconfigurations in one report.
This is one check. A full scan runs them all.
FreeThe WordPress Plugin Check covers one area. A full scan runs every check on the same site in one go, so nothing it does not reach goes unnoticed.
Covered by this check
- 200+ plugin detection
- Plugin version extraction
- Plugin CVE cross-reference
- Outdated plugin detection
- WordPress core version detection
- Active theme identification
- CVSS 3.1 severity scoring
Added by a full scan
- SSL/TLS certificate validation
- Malware & backdoor detection
- HTTP security headers
- DNS security (DNSSEC, SPF, DMARC)
- Domain reputation & blocklists
- Server misconfiguration scanner
- 15+ additional security checks
Want it checked automatically? A free account rescans one site every week and emails you new findings. No credit card.
Start free monitoringMore WordPress and CMS tools
WordPress Version Checker
Detect any site's WordPress core version and whether it is out of date.
WordPress Theme Detector
Identify the active theme on any WordPress site.
WordPress Security Scanner
Full WordPress scan: core, plugins, themes and CVEs.
Website Technology Checker
Identify the full tech stack: CMS, frameworks, servers and more.
Drupal Version Checker
Find the Drupal core version any site is running.
Magento Version Checker
Detect the Magento / Adobe Commerce version of any store.