WP Update Radar · Guide

How to check which WordPress plugins are outdated on a site, without logging in

Agencies often look after client sites they can't log in to every week. You can still see a lot from the outside: which plugins a site loads, and for many of them, which version is installed. Here is how to do it by hand, and which signals to trust.

1. List the plugins the site loads

Open the home page, view the page source, and search for /wp-content/plugins/. The folder name after it is the plugin's slug, for example /wp-content/plugins/contact-form-7/. The slug is also the plugin's address on WordPress.org: wordpress.org/plugins/contact-form-7/.

This only finds plugins that load files on that page. Plugins that run only in the admin area, or only on other pages, won't show up.

2. Find the installed version from a reliable source

Two public signals are dependable:

• The plugin's readme.txt. Many sites still serve /wp-content/plugins/<slug>/readme.txt. Its Stable tag: line normally matches the installed release.
• A generator meta tag. Some plugins print their own version in the page head, for example <meta name="generator" content="Elementor 4.2.3">. Elementor, WooCommerce, Site Kit by Google and Slider Revolution do this.

If both are present they should agree. If they don't, treat the version as unknown.

3. Don't trust ?ver= numbers

Script and stylesheet links often end in ?ver=1.2.3. That number is frequently the version of a bundled library, a theme setting or a cache-buster, not the plugin release. It's a hint at best. Reporting it as the installed version is how people end up telling a client a plugin is outdated when it isn't.

4. Compare with the latest release on WordPress.org

The plugin's WordPress.org page shows the current version. For many sites, the public plugins API is quicker: https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request[slug]=contact-form-7 returns JSON with a version field.

If the installed version is lower, the plugin is outdated. Premium plugins that aren't on WordPress.org can't be compared this way.

5. Check WordPress core and PHP too

Core often shows in a generator tag (WordPress 6.9) or in the RSS feed at /feed/. Some servers send an X-Powered-By: PHP/8.1 header. php.net lists which PHP versions still get security fixes.

Doing this for every client site, every week

By hand this takes a few minutes per site, and plugins update constantly. WP Update Radar runs exactly these checks on your client sites each week and emails one list: each site, each outdated plugin, the installed version and the latest one. It only reads public pages and only reports a version when the plugin's readme or generator tag shows it.