WP Manifestindependent plugin directory
manifest / utilities / mbr-wp-single-site-detector

MBR WP Site Detector WP RegistryHigh-severity findings · 1 findingOpen the reportC-

You’ve probably seen websites that will tell you if a website was built on the WordPress platform, what active theme is being used, and what plugins are detected. This small (11k), lightweight plugin gives you the power to host your own version.

by Robert Palmer · github.com/harbourbob/mbr-wp-single-site-detector · website

★ 0stars
4release downloads
v-1.7.0latest · 5mo ago

Install

Download mbr-wp-site-detector-1.7.0.zip From the v-1.7.0 release on GitHub, May 12, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/harbourbob/mbr-wp-single-site-detector/releases/download/v-1.7.0/mbr-wp-site-detector-1.7.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/harbourbob/mbr-wp-single-site-detector ↗

A plugin that allows visitors to check if any website is built with WordPress and discover what theme and plugins it's using.

Plugin URI

https://littlewebshack.com/

Features

  • WordPress Detection: Identifies if a website is running WordPress
  • Theme Detection: Discovers the active WordPress theme
  • Plugin Detection: Lists visible plugins (those with frontend assets)
  • WordPress Version: Detects the WordPress version being used
  • Buttons: Link to themes and plugins
  • User-Friendly Interface: Clean, responsive design
  • AJAX-Powered: Fast detection without page reloads
  • Security: Proper nonce verification and data sanitization

Installation

  1. Download the plugin files
  2. Upload the entire plugin folder to /wp-content/plugins/
  3. Activate the plugin through the 'Plugins' menu in WordPress
  4. Add the shortcode [wp_detector] to any page or post

Usage

Using the Shortcode

Add the shortcode to any page or post where you want the detector to appear:

[wp_detector]

For Visitors

  1. Enter a website URL (e.g., https://example.com)
  2. Click the "Detect" button
  3. View the results showing:
    • Whether the site is WordPress
    • WordPress version
    • Active theme
    • Detected plugins

File Structure

wordpress-detector/
├── wordpress-detector.php    # Main plugin file
├── assets/
│   ├── css/
│   │   └── detector.css     # Styling
│   └── js/
│       └── detector.js      # AJAX functionality
└── README.md                 # Documentation

Technical Details

Detection Methods

WordPress Detection:

  • Checks for /wp-content/ paths
  • Looks for /wp-includes/ references
  • Identifies WordPress meta generator tags
  • Checks for wp-json API endpoints

Theme Detection:

  • Parses theme paths in stylesheets
  • Attempts to read theme name from style.css

Plugin Detection:

  • Identifies plugin paths in HTML source
  • Only detects plugins that load frontend assets

Limitations

  • Cannot detect all plugins (only those with frontend footprints)
  • Some WordPress sites hide identifying information for security
  • Blocked by CORS and firewall restrictions
  • Security plugins may obscure WordPress signatures

Security

The plugin includes:

  • WordPress nonce verification
  • URL sanitization with esc_url_raw()
  • Input validation
  • XSS protection in JavaScript
  • Secure AJAX handling

Compatibility

  • WordPress 5.0 or higher
  • PHP 7.0 or higher
  • Works with all modern browsers
  • Mobile responsive

Support

For support, please visit: https://robertp419.sg-host.com/wordpress/

Author

Robert Palmer

Changelog

Version 1.5.8

  • Minor bug fixes

Version 1.5.7

  • Initial release
  • WordPress detection
  • Theme identification
  • Plugin discovery
  • WordPress version detection
  • Responsive design
  • AJAX-powered interface

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v-1.7.0 latest
May 12, 2026 5mo ago
mbr-wp-site-detector-1.7.0.zip
2
v-1.6.1
Mar 29, 2026 6mo ago
mbr-wp-site-detector-1.6.1.zip
2
C- grade

Security

MBR WP Site Detector 1.7.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.7.0
Findings
1
Worst severity
high
Content hash
43e379d0541751d2d64e0b4c…

Findings

  • high Unauthenticated SSRF through WordPress site detector AJAX

    ssrf

    The plugin registers wp_ajax_nopriv_detect_wordpress_site and localizes a valid wp_detector_nonce on every front-end page via enqueue_scripts (not gated on shortcode presence). Any visitor can POST site_url to admin-ajax.php; ajax_detect_site only verifies the nonce then calls wp_remote_get() on the attacker-supplied URL (sslverify false), following up with further requests under that host for theme/plugin probing. This enables SSRF against internal services and cloud metadata endpoints from the WordPress server.

    mbr-wp-site-detector.php:55-55,340-357,390-401

    Recommendation

    Remove nopriv registration or require a capability. Only enqueue/localize the nonce when the shortcode is present. Restrict URLs to public http(s) hosts, block private/link-local/metadata IP ranges, enforce a URL allowlist, and do not return raw remote bodies.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →