WordPress Plugin Detector: Plugins, Versions & WooCommerce

Paste websites and see every plugin each WordPress site runs, with versions, checked against the official wordpress.org directory. You see which plugins are outdated, which haven't been updated in two years, and which were removed from wordpress.org (with the reason, e.g. "Security Issue"). You also get the theme, the WordPress version and how far behind it is, WooCommerce store facts (products, currency, payment gateways), hosting, and a short list of findings to pitch. Non-WordPress sites are skipped for free.

Built for WordPress maintenance and security agencies ("your site runs 6 outdated plugins and one pulled for a security issue"), plugin and SaaS vendors (find sites on a competitor's plugin), and WooCommerce service providers (stores, their size and their payment stack).

⚡ How it works

1. Asset paths: every /wp-content/plugins/<slug>/...?ver=<version> the pages load gives the plugin and, usually, its version.
2. REST index: the public /wp-json/ lists the namespaces plugins register (WooCommerce, Yoast, Elementor, Gravity Forms, LearnDash...), which catches plugins that load nothing on the page.
3. wordpress.org Plugins API: each slug gets its real name, latest version, active installs, rating and last update, or the closure notice (date + reason) if the plugin was removed. 60+ premium plugins (Elementor Pro, WP Rocket, Gravity Forms, WPML, WooCommerce Subscriptions...) are named from a built-in list.
4. Theme from the theme's style.css header (name, version, author, parent), WordPress version from core-versioned assets or the RSS generator (never from jQuery's ?ver=), compared with the latest release.
5. WooCommerce: the public Store API gives the product count and currency; payment-gateway plugins are listed.
6. Hosting / CDN from response headers and host-specific plugins (WP Engine, Kinsta, SiteGround, Cloudflare, WordPress VIP...), never from page text.

📋 What you get (per WordPress site)

Field	What it is
plugins	name, slug, category, detectedVersion, latestVersion, activeInstalls, rating, lastUpdated, outdated, abandoned, closed + closedReason, evidence
pluginsByCategory	ecommerce, payments, seo, performance, security, backup, forms, pageBuilder, marketing, analytics, privacy, multilingual, membership, lms, booking, events, media, social, developer...
outdatedPlugins, abandonedPlugins, closedPlugins	The ones to fix (closed = removed from wordpress.org, no more updates)
wordpress	version, latest, releasesBehind, outdated (2+ major releases behind)
theme	slug, name, version, author, parent
woocommerce	isWooCommerce, productsCount, currency, paymentPlugins, storeApiOpen
hosting	WP Engine, Kinsta, SiteGround, Cloudflare, WordPress VIP, GoDaddy, Bluehost...
findings, pitch	Scored findings: removed plugins, outdated plugins, abandoned plugins, old WordPress, no caching / security / SEO / backup plugin

📥 Input

Field	What it does
urls	Websites or domains
datasetId	Any dataset with a website / url / domain field (Google Maps run, lead list, store finder...)
requirePlugins	Keep sites using any of these, e.g. ["woocommerce"], ["elementor"]
excludePlugins	Drop sites using any of these (e.g. your own plugin)
onlyWithIssues	Only sites with outdated / removed plugins or WordPress 2+ releases behind
onlyWooCommerce	Only WooCommerce stores
includeNonWordPress	Also return (unbilled) rows for non-WordPress or unreadable sites

Example: maintenance prospects from a Google Maps search

{ "datasetId": "<your Google Maps scraper dataset>", "onlyWithIssues": true }

Example: WooCommerce stores not on your payment plugin

{ "urls": ["store-one.com", "store-two.com"], "onlyWooCommerce": true, "excludePlugins": ["woocommerce-payments"] }

📤 Output (one row per site, shortened)

{
  "siteName": "WooCommerce",
  "url": "https://woocommerce.com",
  "wordpress": {"version": "7.1.3", "latest": "7.1.3", "releasesBehind": 0, "outdated": false},
  "theme": {"slug": "refer-wordpress", "parent": "woo"},
  "pluginsCount": 7,
  "plugins": [
    {"slug": "woocommerce", "name": "WooCommerce", "category": "ecommerce", "latestVersion": "11.2.1",
     "activeInstalls": 7000000, "rating": 90, "lastUpdated": "2026-10-09",
     "evidence": "asset path /wp-content/plugins/woocommerce/"},
    {"slug": null, "name": "Gravity Forms", "category": "forms", "evidence": "REST namespace gf/v2"}
  ],
  "pluginsByCategory": {"ecommerce": ["WooCommerce", "WooPayments"], "forms": ["Gravity Forms"],
                        "seo": ["Yoast SEO"], "security": ["Akismet"], "suite": ["Jetpack"]},
  "outdatedPlugins": [],
  "closedPlugins": [],
  "woocommerce": {"isWooCommerce": true, "productsCount": 1759, "currency": "USD", "paymentPlugins": ["WooPayments"]},
  "hosting": ["WordPress.com VIP / Automattic"],
  "pitch": ["No backup plugin visible (may be handled by the host)"]
}

A plugin removed from the directory looks like this:

{"name": "Display Widgets", "closed": true, "closedDate": "2021-01-30", "closedReason": "Security Issue"}

💰 Pricing (pay-per-event)

• Site profiled: $0.005 per WordPress site ($5 per 1,000).
• Free: non-WordPress sites and sites that can't be read.
• Filters run after the profile, so every profiled WordPress site is billed.

💡 Use cases

• Maintenance & care-plan agencies: prospects with outdated or removed plugins and old WordPress, plus the exact list to quote.
• Security agencies: sites running plugins pulled from wordpress.org for security issues.
• Plugin vendors: sites on a competitor's plugin (requirePlugins), and sites missing your category (no SEO, caching or security plugin).
• WooCommerce services: store size, currency and payment stack for payment, shipping or marketing providers.
• Hosting companies: sites on a given host or with no caching layer (migration pitch).

🚀 Ready-made tasks

• WordPress Plugin Detector
• Outdated WordPress Plugins Checker
• WooCommerce Store Detector (Products & Payments)

🔌 API, Standby and agents

$curl "https://centorprat--wordpress-plugin-detector.apify.actor/?url=woocommerce.com&token=<YOUR_APIFY_TOKEN>"

from apify_client import ApifyClient
client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("centorprat/wordpress-plugin-detector").call(run_input={"urls": ["woocommerce.com"]})
for s in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(s["url"], s["pluginsCount"], s["outdatedPlugins"], s["closedPlugins"])

MCP: https://mcp.apify.com/?tools=actors,docs,centorprat/wordpress-plugin-detector

❓ FAQ

Can it see every plugin? It sees plugins that load assets on the pages it reads or register a REST namespace, which is most plugins with front-end features. Admin-only plugins with no public trace can't be seen.

How reliable is "outdated"? The version comes from the plugin's own ?ver= asset parameter, which almost all plugins set to their version. Values equal to the WordPress version or that look like timestamps are ignored. Treat outdated as a strong signal, and confirm before quoting.

What does "closed" mean? wordpress.org removed the plugin from the directory. It gets no more updates. The reason is shown (security issue, guideline violation, author request...).

Is the WordPress version always found? When the site exposes it (generator tag, core asset versions or RSS feed). Hardened sites hide it, and then version is null.

Is it legal? It reads public pages, the public REST index and the public wordpress.org API. No login, no scanning, no exploit attempts.

📜 Data & attribution

Public website pages and REST endpoints, plus the public wordpress.org Plugins API. Plugin and theme names belong to their authors.

🔗 Related actors

• Shopify App Detector: Tech Stack, Pixels & Theme: every app a Shopify store runs, with evidence, estimated app spend and change tracking.
• Domain Lookup API - DNS, MX, SPF, Tech & Contact Emails: DNS + live homepage → IPs, MX/SPF, tech, socials and public contacts per domain.
• Google Maps Leads + Website Audit for Agencies: local businesses from Google Maps audited for website, Google profile, reviews, booking and tracking gaps.