CMS Version Checker — WordPress and Joomla core, plugins and themes
Identify which version of WordPress or Joomla a site runs, along with the plugins, components, modules and theme its pages load. Passive only: this reads the public page source and a fixed list of files the CMS itself publishes — nothing is guessed, probed for or changed.
How to read the result
- Core version
- The WordPress or Joomla release the site runs, with the source it was read from and how much weight that source carries. A version from the core manifest or the feed is authoritative; one inferred from an asset is not.
- Branch only
- Shown for WordPress when the exact release cannot be observed. It is a range — 7.0.x covers 7.0 through the latest patch — and deliberately not written as a version.
- Theme or template
- The active design, with its version where the stylesheet header or manifest states one.
- Extensions
- Plugins, components and modules the page loads files from, with versions where the asset URLs carry them.
- Protection
- Appears when the site refused a request for a core file. That is a sign it is hardened, and the reason a version may be missing.
Where this tool is wrong
Every check here reads one signal, and each has a blind spot worth knowing before you act on the answer.
- The extension list is a floor, not an inventory. Anything that adds nothing to the front end of the page is invisible from outside, so a short list does not mean a lean site.
- WordPress security releases change only PHP files, so nothing a visitor can fetch differs between 7.0 and 7.0.4. Where the site states no version, only the branch can be determined — and a patched site looks identical to a vulnerable one at that resolution.
- Joomla publishes its version in files that hardened sites deny. A missing version there usually means the site is well maintained rather than that something went wrong.
- Versions are what a site says about itself. A caching plugin can rewrite them and a manually patched install can report the release it was installed from.
Common questions
Does this tell me whether a site is vulnerable?
No. It reports what is installed, not whether it is exploitable. Matching versions against known vulnerabilities is a separate question, and a version alone answers it badly — a backported security fix leaves the version number unchanged.
Why does it only show a branch for WordPress?
Because the exact release is not observable from outside. WordPress ships security fixes as patch releases that touch only PHP files, so every stylesheet and script a visitor can request is identical across a whole branch. Reporting 7.0 when the site may be running 7.0.4 would be inventing precision.
My Joomla site shows no version. Is something broken?
Almost certainly the opposite. The files Joomla publishes its version in live under /administrator and /language, and hardening guides tell you to block exactly those. A refusal there is a sign the site is looked after.
Is this scan intrusive?
No. It reads the page source any visitor receives and a short, fixed list of files the CMS itself publishes. It does not log in, guess at file paths, or change anything on the site being checked.