Skip to content
install

TWO BUILDS9 browsers

Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build

tool · one of 34free, no counter

WordPress

Is this WordPress, and what is it running?

The usual way to enumerate a WordPress install is to request paths and see what comes back, which is a scan of somebody else’s server rather than a reading of their page. This fetches nothing: it reads the asset URLs the document already contains, and every claim it makes is traceable to a file the browser has already loaded.

Reach itPress ⌘+K on any tab and type wordpress.Ctrl+Kon Windows and Linux

Whether this is WordPress, which theme draws it and what loads with it
readsasset URLs already in the document
requestsnothing - never a guessed path
sendsnothing
content directorydiscovered, never assumed
versionsthe first asset’s answer, and null is an answer
not WordPressan answer, and a headless install looks the same
planfree
Add LoupeKit- opens the list of browsers it can be installed in

TWO BUILDS9 browsers

Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build

in the panel · free, no counter

section#about

What this actually is

Qualifying a site before a project, checking what a client’s install is running, or working out which plugin is responsible for a script you are looking at.

section#asked

Asked about this tool

Why does it not check /wp-content/plugins/ directly?

Because requesting guessed paths is scanning somebody’s server, and this product reads the page in front of you. Everything reported comes from a file the browser already fetched because the page asked for it.

It found nothing on a site I know is WordPress. Why?

A headless install serves a front end that looks like anything else, and a hardened one renames its content directory. Both are reported as "no evidence" rather than as "not WordPress".

Why is a renamed directory not enough on its own?

Because `/assets/plugins/select2/` is how every admin template lays out its vendor scripts. A renamed directory needs a second marker beside it - a generator tag, a `wp-includes` path, a block class - before anything is reported.

Is a detected REST API a problem?

It is stated, not graded. Whether an open REST API matters depends on the site, and this reading has not earned that opinion.

Add LoupeKit- opens the list of browsers it can be installed in

TWO BUILDS9 browsers

Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build

63 of these · no host permissions · three free audits