---
title: New free tool: Software Exposure Checker
description: Your site's headers and HTML can name its web server, PHP, CMS and JavaScript libraries down to the patch release, and scanners use exactly that to pick…
canonical: https://watchfor.io/changelog/2026-10-22-software-exposure-checker
---

[All updates](/changelog#2026-10-22-software-exposure-checker) ✨ New Oct 22, 2026 · v 11.9.7

# New free tool: Software Exposure Checker

Your site's headers and HTML can name its web server, PHP, CMS and JavaScript libraries down to the patch release, and scanners use exactly that to pick targets. The new free Software Exposure Checker reads what one ordinary page load reveals, then grades it A+ to F: every version you show, what is outdated or past end of life, and which known CVEs may apply, with the config that hides each one. It sends one plain GET, never an exploit.

## What it reads

- Headers: Server (nginx, Apache with its modules, IIS, OpenResty, LiteSpeed…), X-Powered-By , X-AspNet-Version , X-Generator , Via and more.

- HTML: the generator tag (WordPress, Joomla, Drupal…), WordPress core asset versions, server signatures on error pages, and JavaScript libraries recognised from their script URLs.

## How it grades

- What you reveal: every version shown is listed with the exact header line or HTML snippet and the setting that hides it. Disclosure alone is mild: any version caps at A, three or more different versions at B. A major version alone, like Apache/2, is only a note.

- Outdated or end of life: each component is placed in its release branch, with the latest release, the end-of-life date and the days left.

- Known CVEs: counted by severity, flagged when CISA lists them as exploited, linked to NVD.

## Honest about what it can't see

- Debian, Ubuntu and Red Hat builds often carry fixes under an older version number. They are never failed on the number alone: they are capped at C and linked to the vendor's tracker to verify.

- A JavaScript library's CVE depends on how the page uses it, so those cap at C and say so.

- Nothing revealed is an A+, with the reminder that we can only see what the page shows.

It also works from a terminal: curl https://watchfor.io/exposure/example.com . The [guide](/blog/what-your-server-headers-reveal) shows how to hide versions on nginx, Apache, IIS, PHP and WordPress.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-10-22-software-exposure-checker · Site guide: https://watchfor.io/llms.txt