What WordPress Theme Is That? How to Find a Site's Theme and Plugins

You land on a WordPress site you like and wonder: what WordPress theme is that, and what plugins does this site use? The answer is usually sitting in the page's HTML. WordPress keeps every theme and plugin in its own folder, and the files they load carry that folder name in their address.

This guide shows the quick way, the manual way, why detection sometimes fails, and what nobody can see from the outside. It ends with the other side of the question: what your own WordPress site reveals to anyone who looks.

The quick way: use a WordPress theme detector#

The fastest option is a detector. Paste the address into our free WordPress theme detector and it reads the page's HTML, finds the theme and plugin folders, and opens the theme's style.css to read its header. You get:

• Whether the site runs WordPress, and the signals that show it.
• The theme's name, version and author, when the theme declares them.
• The parent theme, if the site uses a child theme.
• The plugins that load files on that page, including popular ones like Yoast SEO, Rank Math, WooCommerce and Elementor that announce themselves in the HTML.

For third-party services rather than WordPress plugins, use the script detector. It lists every script the page loads, the domain each one comes from, and whether it is third-party. That is how you spot analytics, tag managers, chat widgets and payment scripts, which often arrive through a plugin or are pasted in by hand.

Both tools only report what the page actually reveals. If a theme or plugin leaves no trace in the HTML, no outside tool can name it.

The manual way: read the page source#

If you want to check by hand, or see why a detector said what it said, you only need a browser.

Step 1: open the page source#

• Chrome, Edge, Firefox: right-click the page and choose View Page Source, or press Ctrl+U (Cmd+Option+U on a Mac).
• Safari: enable the Develop menu in Settings > Advanced, then choose Develop > Show Page Source.

Then use Find (Ctrl+F or Cmd+F) to search the source.

Step 2: confirm it is WordPress#

Search for any of these:

One match is a strong hint. Two or more is close to certain.

Step 3: find the theme folder#

Search for wp-content/themes/. You will see addresses like:

https://example.com/wp-content/themes/example-theme/assets/css/main.css?ver=2.3.1

The part right after /themes/ is the theme's folder name, here example-theme. If you see two different theme folders, the site is probably using a child theme on top of a parent theme.

Step 4: read the theme's style.css header#

Every WordPress theme must have a style.css file in its folder, and the top of that file is a comment block with the theme's details. Open it directly:

https://example.com/wp-content/themes/example-theme/style.css

The header of a child theme looks something like this:

/*
Theme Name: Example Child
Theme URI: https://example.com/
Author: Example Agency
Description: Child theme for example.com
Template: astra
Version: 2.3.1
Text Domain: example-child
*/

The fields to look for:

• Theme Name: the real name, which may differ from the folder name.
• Author and Theme URI: who made it and where to get it.
• Version: the theme version installed.
• Template: only present in child themes. It names the parent theme's folder. If you see Template: astra, the site uses a child theme built on Astra.

If the Theme Name is something like "Client Theme" or the agency's name, it is a custom theme or a renamed child theme. You will not find it in the theme directory, but the Template line may still point to the parent.

Step 5: list the plugin folders#

Search for wp-content/plugins/. Each match shows a folder name:

/wp-content/plugins/woocommerce/assets/css/woocommerce.css?ver=...
/wp-content/plugins/contact-form-7/...
/wp-content/plugins/wordpress-seo/...

The folder name is the plugin's slug. Many slugs read like the plugin's name. Some do not: wordpress-seo is Yoast SEO, seo-by-rank-math is Rank Math and js_composer is WPBakery Page Builder. For a free plugin, you can usually look the slug up at wordpress.org/plugins/<slug>/.

The ?ver= number on a file is often the plugin's version, but not always. Some plugins use the WordPress version or a build number there, so treat it as a clue rather than a fact.

Step 6: look for comments and generator tags#

Some plugins label themselves in the HTML:

• Yoast SEO adds an HTML comment around its tags saying the site is optimized with the Yoast SEO plugin.
• Rank Math adds a similar comment.
• WooCommerce and Elementor add their own generator meta tags.

Search the source for <!-- and generator to find them.

Step 7: read the body classes#

Search for <body. WordPress adds classes to the body tag, such as home, page-template-default or single-post. Themes and page builders often add their own: Astra adds classes starting with ast-, and Elementor adds classes starting with elementor-. A woocommerce class tells you WooCommerce is active. Body classes are a supporting clue, not proof on their own.

Step 8: check more than one page#

Many plugins only load files on the pages where they are used. A form plugin may appear only on the contact page. A WooCommerce extension may appear only on the cart or checkout page. Check the homepage, a blog post, a product page and the contact page for a fuller list.

Why theme and plugin detection sometimes fails#

When a detector or your own search comes up empty, one of these is usually the reason.

Child themes and custom themes#

A child theme may carry a name the agency made up. The Template line in its style.css header usually reveals the parent, but a fully custom theme built from scratch has no public parent to find.

Renamed or combined assets#

Caching and optimization plugins such as WP Rocket, Autoptimize or LiteSpeed Cache can combine and minify CSS and JavaScript into new files, often under /wp-content/cache/. The original plugin paths disappear from the HTML, so plugins that only loaded a CSS file become invisible.

Page builders#

On sites built with Elementor, Divi or similar builders, the theme often does very little. A lightweight theme such as Hello Elementor may be installed, while the design you are admiring comes from the builder and its add-ons. Knowing the theme will not reproduce the look.

Headless WordPress#

Some sites use WordPress only as a content backend, with a separate front end built on a JavaScript framework. The public HTML then contains no theme at all, and often no /wp-content/ paths except for uploaded images.

CDNs and caching layers#

A CDN may serve files from its own domain. The path after the domain usually stays the same, so search for /wp-content/ rather than the site's domain. A firewall or CDN may also block requests from detection tools, which shows up as an error or a challenge page instead of the real HTML.

Security plugins hiding paths#

Some security and "hide WordPress" plugins rename /wp-content/, remove the generator tag and strip version numbers from file addresses. That makes detection much harder, which is the point.

What you cannot see from the outside#

Even on a site with no hiding at all, many plugins leave no trace in the public HTML. If a plugin only works on the server or inside wp-admin, its files never reach the visitor's browser. That usually includes:

• Security and firewall plugins.
• Backup plugins.
• SMTP and email delivery plugins.
• Admin tools, user role editors and activity logs.
• Redirect managers.
• Database and cleanup tools.

So a detector can tell you which plugins a page loads, never the full list of plugins installed. Only someone with admin access can see that, under Plugins > Installed Plugins.

The other side: what your own site reveals#

If you run WordPress sites, run the same checks on them. Anyone, including automated scanners that look for vulnerable plugins, can read what you just learned to read.

The things worth checking:

• Version numbers in file addresses. ?ver= values on theme and plugin files can show which version you run. If that version has a known vulnerability, you have announced it.
• The generator tag. It shows your WordPress version.
• The theme's style.css header. Its Version line is public.
• Plugin readme.txt files. Many plugins ship a readme.txt in their folder, and its Stable tag line usually matches the installed version.

You can remove the core generator tag with one line in a small must-use plugin or a child theme's functions.php:

remove_action( 'wp_head', 'wp_generator' );

Hiding version numbers is not a fix, though. Scanners try known plugin paths anyway, and stripping ?ver= can break cache busting, so visitors keep old CSS after an update. The real protection is keeping themes and plugins updated and removing the ones you do not use. Our WordPress security guide covers the rest.

Updates are where sites break#

Staying updated has its own risk. A plugin, theme or core update can change a layout, remove a button or set a page to noindex, and the page still returns 200 OK, so uptime monitors stay green. If you update often, you need a way to know when an update changed something that matters. See how to safely update WordPress plugins for a step by step routine, and our WordPress maintenance checklist for the regular checks around it.

This is the job the MyKavo WordPress plugin does on your own site. It notices every plugin, theme, WordPress core and translation update, whether you clicked Update or WordPress ran it automatically, plus plugin activations, deactivations and theme switches. After each one, MyKavo checks your monitored pages against your approved baseline and names the update behind any change it finds, for example "Appeared after: Updated WooCommerce 8.1.0 -> 8.2.0". Update checks with verdicts are included in every paid plan, from Starter at $7 a month. On the free plan, updates are still listed, so you can see what changed and when.

You can install it from the WordPress plugin directory. It adds nothing to the pages your visitors load.