Show HN: WP Detective – Show what theme and plugins a WordPress site is using

Neat. Many questions. I assume you have some database of path matches for the theme&#x2F;plugin js&#x2F;CSS files or similar?<p>How extensive is the database? Just free themes&#x2F;plugins from one source, or popular themes from several sources? Paid ones too?<p>Any namespace clashes where you have to dig deeper to tell which theme or plugin it is?<p>Were you able to fully automate the creation and updating of the signature database?

There are a few other websites which do a similar job with similar issues.<p><a href="http:&#x2F;&#x2F;www.wpthemedetector.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.wpthemedetector.com&#x2F;</a><p><a href="http:&#x2F;&#x2F;scanwp.net&#x2F;" rel="nofollow">http:&#x2F;&#x2F;scanwp.net&#x2F;</a><p><a href="http:&#x2F;&#x2F;whatwpthemeisthat.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;whatwpthemeisthat.com&#x2F;</a><p>All these websites scan and output similar unknown plugins, as it sharing the same database or same method to detect plugins and themes.<p><a href="http:&#x2F;&#x2F;wpdetective.io&#x2F;www.pmindia.gov.in" rel="nofollow">http:&#x2F;&#x2F;wpdetective.io&#x2F;www.pmindia.gov.in</a>

So... wpscan[1] with a web frontend?<p>1. <a href="https:&#x2F;&#x2F;github.com&#x2F;wpscanteam&#x2F;wpscan" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;wpscanteam&#x2F;wpscan</a>

hm it doesn&#x27;t seem to pick up the wp installation if the WP_CONTENT_DIR is changed. should be an easy fix, se below.<p>this site is very much wordpress: <a href="https:&#x2F;&#x2F;www.berghs.se&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.berghs.se&#x2F;</a> but wpdetective won&#x27;t detect wordpress at all. it has a custom WP_CONTENT_DIR.<p>here&#x27;s a similar but less polished version my team created some years ago: <a href="http:&#x2F;&#x2F;wppluginchecker.earthpeople.se&#x2F;?wordpress-site=https%3A%2F%2Fwww.berghs.se%2F" rel="nofollow">http:&#x2F;&#x2F;wppluginchecker.earthpeople.se&#x2F;?wordpress-site=https%...</a><p>it tries a few common variables for WP_CONTENT_DIR, and runs completely in the browser, should you want to take a peek on how we detect WP.

Looks like a web UI around wpscan?<p>edit: apparently custom code

Interesting.<p>I&#x27;d be interested in the maintenance strategies you have in place (if any).<p>I assume that for plugins who don&#x27;t output styles or scripts you use other methods, maybe some HTML output etc, so you&#x27;ve probably hard coded a lot of stuff for some popular plugins.<p>How have you set your tests and how do you plan on knowing when a certain plugin stops emitting the signature you&#x27;re checking for? Most probably an E2E test with a local theme containing everything, care to share tech specifics ok this part?

If a wordpress is installed in a subfolder example.com&#x2F;wp&#x2F; it only searches in example.com and doesn&#x27;t detect any wp install.

Very nice. I suppose it works by checking for js&#x2F;css embeds and extracting names from the path?

It doesn&#x27;t seem to work if the wordpress endpoint isn&#x27;t at the root of a domain…

It didn&#x27;t detect revolution slider on my site, which is like one of the most popular plugins.<p>Still great.

This is super useful for freelancers and people working with wordpress themes.

It only detects client side scripts. Nicely done! Tested it on my own shop