CoreScanWP reads plugin asset references from the HTML, crawls a handful of inner pages to catch plugins that only render on specific routes, and actively probes 230 known plugin slugs for the ones that ship no front-end footprint at all.
Three layers, each catching plugins the others miss. The scan is fully passive : only public resources are read.
The homepage usually loads stylesheets, scripts, and
images from /wp-content/plugins/<slug>/.
CoreScanWP extracts every slug it sees and pulls
?ver= query strings to get the version
straight from the asset URL.
Many plugins only load assets on specific routes : a
form plugin on /contact, a checkout plugin
on a product page, an embed plugin on a single post. WP
Scanner extracts internal links and crawls up to five
inner pages so those plugins still surface.
Plenty of plugins have no front-end footprint at all :
they run in wp-admin or as background
workflows. CoreScanWP probes a curated list of 230
popular plugin slugs by requesting each one's
readme.txt, and confirms presence from
that response.
Popular plugins probed when deep scan is on
Inner pages crawled to catch route-specific plugins
CVEs each detected plugin is cross-checked against
Login attempts, exploits, or vulnerability probes
Paste any URL and hit Find the plugins. CoreScanWP reads
every /wp-content/plugins/<slug>/
reference from the HTML, crawls inner pages, and probes
230 popular plugins to surface the ones that ship no
front-end assets.
No external scanner can. Plugins that ship no front-end assets AND aren't in the curated wordlist (custom or premium plugins) stay hidden. CoreScanWP is honest about this : the empty plugin list means none were detectable, not that none exist.
Yes. Plugin asset references live in the HTML and pass through CDNs unchanged. CoreScanWP also identifies the CDN itself (Cloudflare, Fastly, Akamai) so you know what's between you and the origin.
Very. The ?ver= query string on asset URLs
is the canonical version WordPress emits, and the
plugin's own readme.txt double-confirms it
when probed.
Yes. Every detected plugin is cross-checked against 6,853 CVEs in the NIST National Vulnerability Database. Vulnerable versions are flagged with severity, fix version, and a direct link to the advisory.
Only as ordinary page visits in their server logs. WP Scanner does not log in, exploit anything, or trigger security alerts. It only reads public resources.