How the plugin detector finds plugins
Plugins that add anything to the front of a site, a form, a slider, an SEO tag or a cache, leave traces in the page: file paths under /wp-content/plugins/, generator tags and comments in the source. The detector collects those traces from the home page and turns them into a list of plugins.
For each plugin it then looks for the installed version. The plugin’s own readme.txt usually states it, and some plugins print their version in the source. The report tells you where each version number came from, because an asset URL is less exact than a readme.
Reading the plugin list
| Status | What it means |
|---|---|
| Up to date | The installed version matches the latest one on WordPress.org. |
| Update available | WordPress.org has a newer version. Updates often include security fixes. |
| Closed on WordPress.org | The plugin was taken out of the directory, often for a security reason, and no longer gets fixes. |
| Premium or custom | Not on WordPress.org, for example Elementor Pro or a plugin built for that site. |
| Version not visible | The plugin is there, but its version is hidden. |
What it cannot see
Only plugins that load something on the home page are visible from outside. Admin tools, security plugins, backup plugins and plugins used only on other pages stay hidden, so the real list is usually longer than the report. That is true for every plugin detector, and a good reason to be careful with tools that promise to find everything.
The theme, the WordPress version and the security basics are in the same report. If you mainly care about the theme, start from the WordPress theme detector.