# WordPress Site Inspector – Version, Theme & Plugin Detector (`laki-as/wordpress-site-inspector`) Actor

Detect WordPress on any list of websites and get core version, active theme and visible plugins for $0.01 per inspected site (a typical run of 100 sites costs about $1). Reads public pages only, no login. JSON, CSV or Excel export.

- **URL**: https://apify.com/laki-as/wordpress-site-inspector.md
- **Developed by:** [LAKI AS](https://apify.com/laki-as) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.00 / 1,000 site inspecteds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## WordPress Site Inspector – Version, Theme & Plugin Detector

Find out which websites in a list run WordPress, and see the core version, the active theme and the plugins that are visible in public page assets. You pay $0.01 per inspected site. A run of 100 sites typically costs about $1. Sites that cannot be reached are reported and not charged.

### Use cases

- **Lead lists:** filter a list of company websites down to the ones that run WordPress.
- **Agency audits:** see core, theme and plugin versions across many client-facing sites at once.
- **Market research:** count themes and plugins across a sample of sites.
- **Monitoring:** run on a schedule and compare versions over time.

### Output example

One row per site:

```json
{
  "url": "https://www.example.com/",
  "finalUrl": "https://www.example.com/",
  "httpStatus": 200,
  "isWordPress": true,
  "confidence": 1.0,
  "signals": ["api-w-org-link", "core-version:meta-generator", "meta-generator", "wp-content-path", "wp-includes-path", "wp-json-index"],
  "coreVersion": "7.1.3",
  "theme": { "slug": "twentytwentyfive", "version": "1.3" },
  "plugins": [
    { "slug": "contact-form-7", "version": "5.9.8" },
    { "slug": "woocommerce", "version": "9.4.1" }
  ],
  "restApiExposed": true,
  "tech": { "server": "nginx", "poweredBy": null, "generator": "WordPress 7.1.3" },
  "requestsMade": 3,
  "source": "public-website",
  "license": null,
  "fetchedAt": "2026-10-18T17:30:00Z",
  "error": null
}
```

A site that does not run WordPress gets `isWordPress: false`. A site that cannot be checked (DNS failure, timeout, HTTP error) gets `isWordPress: null` and an `error` code, and is not charged.

Export the dataset as JSON, CSV, Excel or XML, or read it through the Apify API. The key-value store also has `REQUEST_LOG` (every HTTP request made) and `SUMMARY`.

### Configuration

| Field | Description |
|---|---|
| `urls` | Domains or URLs, one per line. Each site is checked from its home page. Up to 500 per run (free plan: 10). |
| `maxRequestsPerSite` | Upper limit of HTTP requests per site, redirects included. Default 6, hard limit 8. |

#### How detection works

The Actor reads at most these public paths per site: the home page `/`, the REST API index `/wp-json/`, the RSS feed `/feed/`, and the theme's `style.css` when the page links to it. It looks for `wp-content` and `wp-includes` asset paths, the `api.w.org` link, the generator meta tag, the REST API index and the feed generator. Each signal adds to the confidence score. A site counts as WordPress at a score of 0.5 or more.

There is at least one second between requests to the same host, a 15-second timeout, and the User-Agent identifies the Actor.

### Limitations

- Reads public pages only. It never logs in.
- It does not enumerate users, call `xmlrpc.php`, scan for vulnerabilities or change anything on the site.
- Only plugins that load assets on the home page are visible. Plugins that work only in the admin area or on other pages are not listed.
- Versions are missing when a site hides them (for example, by removing the generator tag or the `?ver=` parameters).
- A home page that redirects to another path, such as `/en/`, is reported as `REDIRECT_TO_DISALLOWED_PATH`. A redirect to a different domain is reported as `REDIRECT_TO_OTHER_SITE`; inspect the target domain directly. Neither is charged.
- Free plan: up to 10 sites per run. The developer set this limit, not Apify.

### FAQ

**Am I charged for sites that fail?** No. Only rows with `error: null` are charged, and that includes sites that turn out not to run WordPress.

**Can it find vulnerable plugins?** No. It reports versions only. You can compare them with a vulnerability database yourself.

**Does it work on WordPress.com or headless sites?** Hosted and headless setups often hide the usual signals, so they may show low confidence or `false`.

**How do I report a problem?** Use the Issues tab on this Actor's page.

# Actor input Schema

## `urls` (type: `array`):

Domains or URLs to inspect, one per line, for example example.com or https://www.example.org. Paths are ignored; each site is checked from its home page. Maximum 500 per run.

## `maxRequestsPerSite` (type: `integer`):

Upper limit of HTTP requests per site, including redirects. Most sites need 2-4. Hard limit 8.

## Actor input object example

```json
{
  "urls": [
    "https://fagur.no",
    "https://nettsidesjekken.no"
  ],
  "maxRequestsPerSite": 6
}
```

# Actor output Schema

## `sites` (type: `string`):

One row per site with WordPress detection, version, theme and plugins.

## `requestLog` (type: `string`):

Every HTTP request made (host, path, status).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://fagur.no",
        "https://nettsidesjekken.no"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("laki-as/wordpress-site-inspector").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "https://fagur.no",
        "https://nettsidesjekken.no",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("laki-as/wordpress-site-inspector").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://fagur.no",
    "https://nettsidesjekken.no"
  ]
}' |
apify call laki-as/wordpress-site-inspector --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,laki-as/wordpress-site-inspector"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/3yA4kAhnU121sYdNY/builds/K7mDVtA6YoaJJtRnS/openapi.json