Yes. It only reads what any visitor's browser already sees — public HTML, response headers, and publicly served files like a theme's style.css. It never logs in, brute-forces paths, or accesses anything private.

No. It's entirely read-only from the outside — nothing is written to, uploaded to, or installed on the site being scanned.

Detection relies on signatures left in the public page source — file paths, version query strings, and a theme's style.css header. Heavily customized builds, aggressive asset minification/concatenation, or premium plugins not hosted on WordPress.org can hide those signatures.

It checks the plugin's slug against the WordPress.org plugin directory. That works well for free, WordPress.org-hosted plugins. Premium or custom plugins aren't listed there, so their status shows as "unverified" rather than a guess.

Yes — running a scan doesn't require an account.

Yes, please do — there's a dedicated suggestions page linked in the footer.