Site fingerprinting tool
Paste any WordPress URL and VedaX reads the source, headers, and asset fingerprints to surface the theme, every active plugin, and the hosting stack behind it — no login, no install.
Sample output
| Plugin | Category | Version | Status | Confidence |
|---|---|---|---|---|
WooCommerce |
Ecommerce | 9.4.1 | Current | |
Yoast SEO |
SEO | 23.6 | Current | |
Contact Form 7 |
Forms | 5.8.4 | 2 versions behind | |
Elementor |
Page builder | 3.26.0 | Current | |
Wordfence Security |
Security | 7.11.7 | Current | |
WP Rocket |
Caching | 3.15.11 | 1 version behind | |
Akismet |
Spam filter | 5.3.3 | Current |
The process
Works on any publicly reachable page — a homepage, a product page, or a blog post all give enough signal.
Source markup, enqueued assets, HTTP response headers, and DNS records are matched against a maintained signature index.
Theme, active plugins with version numbers, hosting provider, and key performance signals — ready to export or share.
Built for
Identifies the active parent theme, any child theme, and the page builder layered on top.
Flags outdated plugins against their public changelog so you know what to check first on a new client site.
Server software, PHP version, CDN provider, and TLS configuration, pulled straight from response headers.
Checks a site's /wp-json/ namespaces to catch plugins with no front-end footprint — security, backup, and SMTP plugins included.
Detected plugin versions are compared against WordPress.org's directory in real time, so outdated ones are flagged automatically.
Every scan is read-only, with built-in checks that block private and internal addresses from being targeted.
Get started
No account required to try it. Just paste a link and see what's running.