How to Detect What WordPress Theme (and Stack) a Website Uses

#wordpress #javascript #webdev #tutorial

You land on a slick website and wonder: is this WordPress, and if so, what theme is it running? You can usually answer both in under a minute by reading a few signals the site leaves in its HTML and a couple of predictable endpoints. Here is how to do it by hand, and how to script it.

The five signals that give WordPress away

WordPress leaves fingerprints. Any one of these is a strong hint; two or more is near certainty.

Asset paths contain /wp-content/ or /wp-includes/
A login page exists at /wp-login.php (and /wp-admin/ redirects to it)
The generator meta tag: <meta name="generator" content="WordPress 6.x">
The REST API responds at /wp-json/
The theme path: styles load from /wp-content/themes/<theme-name>/

That last one is the good part. The folder name after /themes/ is usually the theme slug.

Checking by hand

Open the page source (Ctrl+U) and search for wp-content. If it is there, it is almost certainly WordPress. Then search for /themes/ to read the theme slug:

https://example.com/wp-content/themes/astra/style.css
                                    ^^^^^ theme slug

Hit /wp-json/ in the address bar. A JSON response with name, description, and routes confirms WordPress and often leaks the site title and active plugins via the REST routes.

Scripting it

Here is a minimal Node check that fetches the HTML and reports the signals:

async function detectWordPress(url) {
  const html = await fetch(url).then(r => r.text());

  const isWP =
    /wp-content|wp-includes/.test(html) ||
    /<meta name="generator" content="WordPress/i.test(html);

  const theme = html.match(/\/wp-content\/themes\/([^\/'"]+)/)?.[1] ?? null;

  const generator = html.match(
    /<meta name="generator" content="(WordPress[^"]*)"/i
  )?.[1] ?? null;

  return { url, isWP, theme, generator };
}

detectWordPress("https://example.com").then(console.log);
// { url: "...", isWP: true, theme: "astra", generator: "WordPress 6.6" }

For plugins, scan asset URLs for /wp-content/plugins/<plugin-slug>/. Each unique slug is a plugin loading a script or stylesheet on the front end.

const plugins = [...html.matchAll(/\/wp-content\/plugins\/([^\/'"]+)/g)]
  .map(m => m[1]);
console.log([...new Set(plugins)]);

Why detection sometimes fails

It is not foolproof, and it is worth knowing the blind spots:

Headless WordPress: the front end is React or Next.js, so wp-content never appears. The /wp-json/ endpoint may still respond.
Security plugins rename the login URL and strip the generator tag.
Aggressive caching/optimization can rewrite or inline asset paths, hiding theme folders.
CDNs sometimes serve assets from a different host, so match the path, not the domain.

So treat a negative result as "probably not, but check /wp-json/ before you are sure."

When you just want the answer

If you do not want to open a console, paste the URL into the WordPress Theme Detector on Pixellize. It runs these same checks and returns the theme name, version, author, and detectable plugins in one view. It is the scripted logic above with a UI, and it is free.

Wrap up

WordPress is one of the easiest platforms to fingerprint: wp-content in the source, a /wp-login.php page, the generator tag, and a live /wp-json/ endpoint. Read the /themes/<slug>/ path for the theme and /plugins/<slug>/ for plugins. Script it for bulk checks, or run a single URL through the detector when you just need a fast answer.

DEV Community