WordPress Site Inspector – Version, Theme & Plugin Detector

Find out which websites in a list run WordPress, and see the core version, the active theme and the plugins that are visible in public page assets. You pay $0.01 per inspected site. A run of 100 sites typically costs about $1. Sites that cannot be reached are reported and not charged.

Use cases

• Lead lists: filter a list of company websites down to the ones that run WordPress.
• Agency audits: see core, theme and plugin versions across many client-facing sites at once.
• Market research: count themes and plugins across a sample of sites.
• Monitoring: run on a schedule and compare versions over time.

Output example

One row per site:

{
  "url": "https://www.example.com/",
  "finalUrl": "https://www.example.com/",
  "httpStatus": 200,
  "isWordPress": true,
  "confidence": 1.0,
  "signals": ["api-w-org-link", "core-version:meta-generator", "meta-generator", "wp-content-path", "wp-includes-path", "wp-json-index"],
  "coreVersion": "7.1.3",
  "theme": { "slug": "twentytwentyfive", "version": "1.3" },
  "plugins": [
    { "slug": "contact-form-7", "version": "5.9.8" },
    { "slug": "woocommerce", "version": "9.4.1" }
  ],
  "restApiExposed": true,
  "tech": { "server": "nginx", "poweredBy": null, "generator": "WordPress 7.1.3" },
  "requestsMade": 3,
  "source": "public-website",
  "license": null,
  "fetchedAt": "2026-10-18T17:30:00Z",
  "error": null
}

A site that does not run WordPress gets isWordPress: false. A site that cannot be checked (DNS failure, timeout, HTTP error) gets isWordPress: null and an error code, and is not charged.

Export the dataset as JSON, CSV, Excel or XML, or read it through the Apify API. The key-value store also has REQUEST_LOG (every HTTP request made) and SUMMARY.

Configuration

Field	Description
urls	Domains or URLs, one per line. Each site is checked from its home page. Up to 500 per run (free plan: 10).
maxRequestsPerSite	Upper limit of HTTP requests per site, redirects included. Default 6, hard limit 8.

How detection works

The Actor reads at most these public paths per site: the home page /, the REST API index /wp-json/, the RSS feed /feed/, and the theme's style.css when the page links to it. It looks for wp-content and wp-includes asset paths, the api.w.org link, the generator meta tag, the REST API index and the feed generator. Each signal adds to the confidence score. A site counts as WordPress at a score of 0.5 or more.

There is at least one second between requests to the same host, a 15-second timeout, and the User-Agent identifies the Actor.

Limitations

• Reads public pages only. It never logs in.
• It does not enumerate users, call xmlrpc.php, scan for vulnerabilities or change anything on the site.
• Only plugins that load assets on the home page are visible. Plugins that work only in the admin area or on other pages are not listed.
• Versions are missing when a site hides them (for example, by removing the generator tag or the ?ver= parameters).
• A home page that redirects to another path, such as /en/, is reported as REDIRECT_TO_DISALLOWED_PATH. A redirect to a different domain is reported as REDIRECT_TO_OTHER_SITE; inspect the target domain directly. Neither is charged.
• Free plan: up to 10 sites per run. The developer set this limit, not Apify.

FAQ

Am I charged for sites that fail? No. Only rows with error: null are charged, and that includes sites that turn out not to run WordPress.

Can it find vulnerable plugins? No. It reports versions only. You can compare them with a vulnerability database yourself.

Does it work on WordPress.com or headless sites? Hosted and headless setups often hide the usual signals, so they may show low confidence or false.

How do I report a problem? Use the Issues tab on this Actor's page.