DotComPals - Come, grow with the web

WordPress Site Checker

See which WordPress version, theme and plugins a site shows publicly, and whether common exposure points are open.

Enter a domain only, no http:// needed.

How this works

  1. We detect WordPress from the homepage and read the generator tag, theme and plugin folders.
  2. We compare the version with the latest release reported by wordpress.org.
  3. We make four ordinary public requests (REST API, user list, xmlrpc.php, readme.html). We only count results, we never show usernames.

Frequently asked questions

Is this a vulnerability scanner?

No. It does passive checks of public information. It does not test passwords or exploit anything.

My version is hidden. Is that good?

Hiding it is good practice but not security by itself. Keep core, themes and plugins updated.

Should I disable xmlrpc.php?

Usually yes, unless the Jetpack plugin or a mobile app needs it.

Why can't it see all my plugins?

Only plugins that load files on the homepage are visible.

More free tools

Website Tech and Tracking Detector | Security Headers and Redirect Checker | PageSpeed and Core Web Vitals Checker | Website Project Brief Builder | All free tools