When I don't have the admin access to a site, how can I find out the modules that are enabled on the site.

For example : How can I identify various modules enabled on www.drupal.org

1 Answer 1


There are various you can find this out. But none of them are foolproof and they are just dirty tricks at best.

You can check source(view source) of the website and do the following.

  1. Check the css includes in the head tag and figure out the modules from path.
  2. Check the javascript includes in the head tag and figure out the modules from the path.
  3. Check the classes of html tags from the body tag.
  4. Do the above for multiple standard pages and you should be able to make a list of at-least 50% of the websites based on your knowledge of the modules.

But the easiest of them all is using the http://www.drupalxray.com/ website. Looks like they have automated many rules like the above and search enough paths to prepare a pretty exhaustive list of modules used on a website.

  • 1
    Drupal Xray is really interesting-- I just scanned my site with it, and it even reveals modules that are in the codebase but not enabled. Commented Nov 20, 2014 at 14:56
  • 1
    @PatrickKenny how on earth can it scan the modules in your codebase? I am assuming you must have enabled those modules sometime and then disabled them, hence leaving some traces in the database.
    – Gokul N K
    Commented Nov 20, 2014 at 14:59
  • 2
    @GokulNK If the site is pre 7.32 then it'd be easy! But yeah, not possible otherwise. They can only be going off of markup and/or file structure. Nothing else would make sense. It'd be easy to find out, actually - set up a test site with full request logging, then let Xray loose on it. Inspecting the access logs will tell you what they've used to make decisions
    – Clive
    Commented Nov 20, 2014 at 15:02
  • @Clive Thanks for the suggestion. I was really curious about what they are using. In fact checked their AJAX calls but was not able to make much out of it. Your pointer regarding access logs makes sense. On it now ;)
    – Gokul N K
    Commented Nov 20, 2014 at 15:15
  • 2
    @Clive I enabled the access logs and looks like they are targeting the static files in the modules. They are using HEAD requests to check the presence of the static files. PatrickKenny what you mentioned was right. They are not targeting the database urls. They are targeting the static files in the modules and hence even if a module is not enabled, drupalxray.com would still list them :)
    – Gokul N K
    Commented Dec 3, 2014 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.