Indicate which plugin provides an UnprotectedRootAction

core/src/main/resources/hudson/security/LegacySecurityRealm/config.groovy

@@ -0,0 +1,31 @@
+package hudson.security.LegacySecurityRealm
+
+import hudson.PluginWrapper
+import hudson.model.UnprotectedRootAction
+import jenkins.model.Jenkins
+
+def f = namespace(lib.FormTagLib)
+
+f.entry(title: _('Unprotected URLs')) {
+    p(_('blurb'))
+    ul {
+        for (def action : Jenkins.get().getActions().sort { x, y -> x.getUrlName() <=> y.getUrlName() }) {
+            if (action instanceof UnprotectedRootAction) {
+                li {
+                    a(href: '../' + action.getUrlName(), target: '_blank') {
+                        code {
+                            text(action.getUrlName())
+                        }
+                    }
+                    br()
+                    PluginWrapper whichPlugin = Jenkins.get().getPluginManager().whichPlugin(action.getClass())
+                    if (whichPlugin == null) {
+                        text(_("byCore"))
+                    } else {
+                        raw(_("byPlugin", whichPlugin.getDisplayName(), whichPlugin.getUrl()))
+                    }
+                }
+            }
+        }
+    }
+}

core/src/main/resources/hudson/security/LegacySecurityRealm/config.properties

@@ -23,3 +23,5 @@
 blurb=\
     These URLs (and URLs starting with these prefixes plus a /) should require no authentication. \
     If possible, configure your container to pass these requests straight to Jenkins without requiring login.
+byCore=(provided by Jenkins core)
+byPlugin=(provided by <a href="{1}" target="_blank">{0}</a>)