---
title: Software Exposure Checker: Versions, EOL & CVEs
description: See which software versions your website reveals in its headers and HTML — web server, PHP, CMS, JavaScript libraries — and whether any is outdated, past end of life or has known CVEs. Graded A+ to F, with the fix for each. One plain GET, no signup.
canonical: https://watchfor.io/software-exposure-checker
---
[Back to all free tools](/free-tools)
Software Exposure Checker
# What does your website reveal? Find exposed versions, outdated software and known CVEs
See which software versions your website reveals in its headers and HTML — web server, PHP, CMS, JavaScript libraries — and whether any is outdated, past end of life or has known CVEs. Graded A+ to F, with the fix for each. One plain GET, no signup.
[How to use this tool](/blog/what-your-server-headers-reveal)
Result
No result yet
Fill in the form above and run it — the result appears here.
Monitor this 24/7 — get alerted when a failure is confirmed.
[Start free](/auth/sign-up)
Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms).
## The software exposure grade scale
Every check returns one of these grades, with each signal we read and the fix for it. Showing a version only costs a little; running something outdated or with known CVEs costs more. Distribution builds and front-end libraries are never failed on a version number alone, and a page we couldn't read gets no grade at all.
A+ Excellent
Nothing in the headers or the HTML names a software version, and nothing we could identify is outdated. We can only see what the page shows.
A Good
Versions are visible, but every component we could place is current, with no known CVE.
B Needs attention
Something is behind its latest patch release or loses support within six months, a medium-severity CVE may apply, or three or more software versions are revealed.
C Weak
A distribution build whose version falls in a vulnerable or end-of-life range (verify with your vendor), or a front-end library with a high or critical CVE or past end of life.
D Poor
Server or CMS software past end of life, or in the range of a high-severity CVE.
F Failing
Server or CMS software in the range of a known-exploited or critical CVE, or more than two years past end of life.
## Every rule, in full
The grade starts at A+ and each problem can only lower the ceiling, so the grade is always explained by the worst finding in the report. Rules version exposure-2026.10 .
Grade at most When
F An exact server, runtime or CMS version in the range of a CVE in CISA's Known Exploited Vulnerabilities catalog, or of any CVE scored 9.0 or higher
F An exact version of a long-lifecycle product (PHP, OpenSSL, Apache httpd, Tomcat, IIS, Drupal, Joomla) more than two years past end of life — e.g. PHP 5 or 7, OpenSSL 1.0.x or 1.1.1
F PHP graded F by the PHP Version Checker's rubric (php2shell, an exploited or critical CVE, end of life over two years)
D Server, runtime or CMS software past end of life (nginx at worst D: every branch ends when the next ships)
D An exact server, runtime or CMS version in the range of a high-severity CVE (CVSS 7.0–8.9)
D An inferred version (WordPress's ?ver=, nginx under OpenResty) that would otherwise be F
C A distribution build (Debian, Ubuntu, Red Hat, SUSE — from the version suffix, the Server header's OS token, or an exact version only a distribution ships) that would otherwise be D or F: the vendor may have backported the fix, so verify
C A front-end JavaScript library with a known-exploited, critical or high-severity CVE, or past end of life: whether the bug is reachable depends on how the page uses the library
B A component behind the latest patch release of its branch, or a branch that loses support within six months
B A medium-severity CVE (CVSS 4.0–6.9) may apply
B 3 or more distinct software versions are revealed (the same version in two places counts once)
A Any header or HTML signal names a software version, even a current one (front-end library URLs don't count: nobody hides those; a major version alone, like Apache/2 or Drupal 10, is a note)
— Products shown without a version, and versions we have no release data for: listed, not graded
— The page did not load, or we were shown a bot challenge instead of it: no grade
[How WatchFor grades everything the same way](/grades#software-exposure)
## What is Software Exposure Checker ?
Every response your website sends can say which software made it. Server: Apache/2.4.29 (Ubuntu) names the web server, its version and the operating system; X-Powered-By: PHP/7.4.33 names the runtime; names the CMS to the patch release; a script loaded from /ajax/libs/jquery/1.12.4/ names a front-end library. None of that is a vulnerability by itself. All of it tells a stranger which known bugs are worth trying first — mass scanners for a new CVE start exactly there.
This free software exposure checker reads those signals from the outside, the way a scanner would, from one ordinary page load. It lists every version your headers and HTML reveal, places each component against its release calendar (current, behind its latest patch, past end of life), matches it against known CVEs from NVD and retire.js with CISA's Known Exploited Vulnerabilities flag, and grades the whole picture A+ to F with the exact fix for each finding. It only sends one normal GET request. Nothing exploit-like ever leaves our probes.
## How it works
One URL in, a graded answer out:
- 1 One normal request — A probe location near you fetches the page with a plain GET, follows redirects, and keeps the response headers and the first 256 KB of the HTML. It never downloads the scripts the page loads, never guesses paths and never sends anything but an ordinary request. That is the whole conversation.
- 2 Read the signals — Headers: Server with every module in it (Apache, OpenSSL, PHP, mod_perl…), X-Powered-By , X-AspNet-Version , X-AspNetMvc-Version , X-Generator , Via , the Drupal and Varnish headers and a few product-specific ones. HTML: the generator tag, WordPress core asset versions ( ?ver= on its own files only), server signatures on error pages, and front-end libraries recognised from their script URLs — retire.js's URL patterns plus the versioned paths of the public CDNs (cdnjs, jsDelivr, unpkg, Google Hosted Libraries). PHP is read by the same parser as the [PHP Version Checker](/php-version-checker).
- 3 Match it against the data — Each version is placed in its release branch from endoflife.date and php.net, compared with the branch's latest release and its end-of-life date, and matched against the affected ranges of known CVEs: NVD for nginx, Apache httpd, OpenSSL, Tomcat, PHP, WordPress, Drupal and Joomla, retire.js for front-end libraries, flagged where CISA lists them as exploited. The data is refreshed every few hours.
- 4 Grade it — The grade starts at A+ and every finding can only lower it: a known-exploited or critical CVE in an exact server or CMS version, or a long-lifecycle product more than two years past end of life, is an F; end of life or a high-severity CVE a D; a distribution build or a front-end library in a vulnerable range a C; anything behind its latest patch a B; any version shown at all an A. The full rule table is under the tool.
A version number is a lead, not proof. Distribution builds backport fixes under the old number, and a front-end library's CVE depends on how the page uses it — the result says "may be affected" and "verify" where that is the honest answer.
## When you'd use it
### Before a scanner does it for you
A new CVE in Apache, nginx or WordPress is published and the internet-wide scans start within hours. One run shows whether your site announces an affected version — and since the version is public, so does everyone else's scanner.
### After an upgrade or a migration
A package upgrade resets security.conf , a new server joins the pool with default settings, a CDN in front stops stripping headers. Run the check after the change: the version the page announces now is the one the world sees.
### Auditing an inherited or client site
An agency site from 2019, a marketing microsite nobody remembers, a client's shared hosting plan. One run lists its server, PHP, CMS and front-end libraries, flags what is past end of life, and gives you a link to send to whoever owns it.
### Hardening checklists and pen-test prep
Version disclosure is a standard finding in security reviews. The check lists every signal with the exact header line or HTML snippet and the config that removes it, so you can close them before the auditor writes them up.
## Reading the result
### The grade and the first thing to fix
The letter is capped by the worst finding, and the line under it names that finding. Every finding is listed worst first with what it means, the highest grade it allows and the fix.
### What you reveal
A table of every signal: where it is (a header or the HTML), the exact evidence — for example Server: nginx/1.18.0 (Ubuntu) or a script URL — the product and version it names, and how sure we are: exact (the software states it), distro build (a Debian, Ubuntu, Red Hat or SUSE package) or inferred (read from something not meant as a version statement). Products shown without a version are listed too.
### Components
One card per product and version, worst first, with a status pill: current , outdated (behind the latest patch release of its branch), EOL (past end of life), verify (a distribution build in a vulnerable or end-of-life range) or unknown (no release data, or only a major version shows). Each card shows the latest release, the end-of-life date with the days left, CVE counts by severity with KEV flags, and the top CVEs linked to NVD.
### What to fix
Every finding with its fix, worst first: the release to upgrade to, and for each disclosure the ready-to-paste config for nginx, Apache, IIS, PHP, WordPress, Express, Next.js or Cloudflare.
### PHP
When the page shows a PHP version, its verdict is the [PHP Version Checker](/php-version-checker)'s grade, so both tools agree. The PHP card links to the full PHP report with the branch calendar, the patch gap and the exact release to install.
## What the checker detects
From one response: the headers in full and the first 256 KB of the HTML. Confidence says how much the version proves.
Where Signals Products Confidence
Server header nginx/1.18.0 (Ubuntu) , Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 , Microsoft-IIS/10.0 , openresty/1.21.4.1 nginx, Apache httpd and its modules, OpenSSL, PHP, IIS, OpenResty, LiteSpeed, Caddy, Jetty, Gunicorn… exact; distro build with an OS token or a distribution suffix; nginx under OpenResty inferred
X-Powered-By , X-AspNet-Version , X-AspNetMvc-Version PHP/8.1.2-1ubuntu2.19 , ASP.NET , 4.0.30319 , Express , Next.js PHP, ASP.NET, Express, Next.js, servlet containers exact, or distro build from the version suffix
Other headers X-Generator , X-Drupal-Cache , Via , X-Varnish , X-Pingback , Liferay-Portal , X-Jenkins , session cookie names Drupal, Varnish, Squid, WordPress, Liferay, Jenkins, Exchange, SharePoint exact, or present without a version
Meta generator WordPress 6.4.3 , Joomla! - Open Source Content Management , Drupal 10 , TYPO3 CMS , Hugo 0.121.1 WordPress, Joomla, Drupal, TYPO3, Ghost, MediaWiki and any generator that names itself exact (Drupal shows only its major version)
WordPress core assets wp-emoji-release.min.js?ver=5.8 , block-library/style.min.css?ver=6.4.3 WordPress inferred
Script and stylesheet URLs /ajax/libs/jquery/1.12.4/jquery.min.js , bootstrap@4.0.0 , jquery-1.8.3.min.js jQuery, jQuery UI, Bootstrap, AngularJS, Vue, Lodash, Moment.js, Handlebars, DOMPurify, Select2 and every library retire.js knows exact (the URL pins the release)
Error pages Apache/2.4.29 (Ubuntu) Server at … , nginx/1.18.0 , Apache Tomcat/9.0.31
Apache httpd, nginx, Tomcat exact or distro build
## End-of-life dates for common web server software
Supported branches of each product, newest first, with recent end-of-life branches still seen in the wild. Days are counted from today; data as of Oct 22, 2026.
Product Branch Latest End of life Days left
nginx 1.31 (mainline) 1.31.8 No date announced —
nginx 1.30 (stable) 1.30.6 No date announced —
nginx 1.29 1.29.8 May 13, 2026 ended 162 days ago
nginx 1.28 1.28.3 Apr 14, 2026 ended 191 days ago
nginx 1.18 1.18.0 Apr 20, 2021 ended 2,011 days ago
Apache HTTP Server 2.4 2.4.69 No date announced —
Apache HTTP Server 2.2 2.2.34 Jul 11, 2017 ended 3,390 days ago
OpenSSL 4.0 4.0.3 May 14, 2027 204 days left
OpenSSL 3.6 3.6.5 Nov 1, 2026 10 days left
OpenSSL 3.5 3.5.9 Apr 8, 2030 1,264 days left
OpenSSL 3.4 3.4.8 Oct 22, 2026 ends today
OpenSSL 3.0 3.0.22 Sep 7, 2026 ended 45 days ago
OpenSSL 1.1.1 1.1.1w Sep 11, 2023 ended 1,137 days ago
OpenSSL 1.0.2 1.0.2u Dec 31, 2019 ended 2,487 days ago
Apache Tomcat 11.0 11.0.27 No date announced —
Apache Tomcat 10.1 10.1.61 No date announced —
Apache Tomcat 9.0 9.0.123 Mar 31, 2027 160 days left
Apache Tomcat 8.5 8.5.100 Mar 31, 2024 ended 935 days ago
Microsoft IIS 10.0 10.0 No date announced —
Microsoft IIS 8.5 8.5 Oct 10, 2023 ended 1,108 days ago
Microsoft IIS 7.5 7.5 Jan 14, 2020 ended 2,473 days ago
PHP 8.5 8.5.12 Dec 31, 2029 1,166 days left
PHP 8.4 8.4.27 Dec 31, 2028 801 days left
PHP 8.3 8.3.36 Dec 31, 2027 435 days left
PHP 8.2 8.2.35 Dec 31, 2026 70 days left
PHP 8.1 8.1.34 Dec 31, 2025 ended 295 days ago
PHP 7.4 7.4.33 Nov 28, 2022 ended 1,424 days ago
WordPress 7.1 7.1.3 No dates: security releases also go to older branches —
Drupal 11.4 11.4.11 Jul 7, 2027 258 days left
Drupal 11.3 11.3.20 Dec 16, 2026 55 days left
Drupal 10.6 10.6.20 Dec 16, 2026 55 days left
Drupal 7.x 7.103 Jan 5, 2025 ended 655 days ago
Joomla! 6.x 6.2.0 Oct 16, 2029 1,090 days left
Joomla! 5.x 5.4.10 Oct 12, 2027 355 days left
Joomla! 4.x 4.4.14 Oct 14, 2025 ended 373 days ago
Joomla! 3.x 3.10.12 Aug 17, 2023 ended 1,162 days ago
jQuery 4.x 4.0.0 No date announced —
jQuery 3.x 3.7.1 No date announced —
jQuery 2.x 2.2.4 May 20, 2016 ended 3,807 days ago
jQuery 1.x 1.12.4 May 20, 2016 ended 3,807 days ago
Bootstrap 5.x 5.3.8 No date announced —
Bootstrap 4.x 4.6.2 Jan 1, 2023 ended 1,390 days ago
Bootstrap 3.x 3.4.1 Jul 24, 2019 ended 2,647 days ago
AngularJS 1.8 1.8.3 Dec 31, 2021 ended 1,756 days ago
Vue.js 3.5 3.5.44 No date announced —
Vue.js 2.7 2.7.16 Dec 31, 2023 ended 1,026 days ago
## Check it yourself
The headers that matter, from a terminal — or the same graded check from ours:
curl -sI https://example.com | grep -iE '^(server|x-powered-by|x-aspnet(mvc)?-version|x-generator|via):'
curl -s https://example.com | grep -io ']*>'
curl https://watchfor.io/exposure/example.com Error pages often say more than the home page: try a URL that doesn't exist, too. On the server, nginx -v , apache2 -v (or httpd -v ) and openssl version print what is installed — and the package manager says whether a distribution build carries the fixes.
## Common pitfalls
### Hiding the version instead of upgrading
server_tokens off and expose_php = Off change what the page says, not what runs. A hidden Apache 2.4.49 is still exploitable through CVE-2021-41773. Patch first, then hide.
### Reading a distribution version as upstream
Ubuntu 18.04's Apache says 2.4.29 for its whole life; Red Hat 7's says 2.4.6 . Both get security fixes under the old number. The checker caps such builds at C and asks you to verify in the vendor's tracker — and you should verify, because only the package changelog knows.
### Fixing the header but not the error pages
ServerTokens Prod shortens the header; Apache's ServerSignature still prints the full version at the bottom of every 404 and directory listing, and nginx's own error pages print it until server_tokens off . Check a URL that doesn't exist after the change.
### A CDN that hides one header and passes the rest
Cloudflare replaces Server with its own, which makes a site look clean while X-Powered-By , the generator tag and the script URLs still pass through untouched. Hide versions at the origin, or remove the headers with a Transform Rule.
### Treating a front-end library CVE as automatically exploitable — or as harmless
A jQuery or Bootstrap CVE matters when the page feeds untrusted input to the affected function. The checker can't see that, so these cap at C and say so. Upgrading is usually cheaper than proving you are safe.
## Run Software Exposure Checker on every change, not just once.
Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card.
[Start free](/auth/sign-up)
## Frequently asked questions
What is software version exposure? It is your website telling every visitor which software and which versions run behind it — in the Server and X-Powered-By headers, the generator tag, WordPress asset URLs, script URLs and error pages. Attackers use those version numbers to pick which known bugs to try first. This checker lists every signal your page gives away, flags what is outdated or past end of life and which known CVEs may apply, and shows how to hide each one.
Is hiding version numbers security through obscurity? Yes, in the plain sense: it changes what a stranger can see, not what runs. That is why the grade treats disclosure mildly — any version shown caps at A, 3 or more distinct versions at B — while outdated and vulnerable software costs far more. Hiding is still worth doing: it takes your site off the cheap target lists scanners build from version banners. Patch first, hide second.
My Debian or Ubuntu server shows an old version. Is it vulnerable? Not necessarily. Debian, Ubuntu, Red Hat and SUSE backport security fixes into their packages without changing the upstream version number, so Apache/2.4.29 (Ubuntu) can be fully patched. That is why the checker marks such builds verify and caps them at C instead of failing them, and links each CVE to the vendor's tracker. Check the package changelog — apt changelog apache2 | grep CVE-… or rpm -q --changelog httpd | grep CVE-… — and make sure your release still gets updates at all. A plain nginx/1.22.1 with no OS token is treated the same way, because that is the exact version Debian 12 ships.
Why do JavaScript library CVEs only cap at C? Because whether the bug is reachable depends on how your page uses the library, and that can't be seen from outside. A jQuery cross-site scripting CVE matters if the page passes untrusted HTML to the affected method; it may not matter at all if it doesn't. The result says "may be affected" and explains this. Upgrading is still the right move — it is usually cheaper than an audit proving you are safe.
How do I hide the nginx version? Add server_tokens off; to the http block (or each server block) and reload nginx. The Server header then reads just nginx , and the version disappears from nginx's own error pages too. Removing the header completely needs the headers-more module ( more_clear_headers Server; ) or a CDN in front. If PHP runs behind nginx, also add fastcgi_hide_header X-Powered-By; .
How do I hide the Apache version? Set ServerTokens Prod (the header then reads just Apache ) and ServerSignature Off (no version footer on error pages and directory listings) — on Debian and Ubuntu both live in /etc/apache2/conf-available/security.conf . Add Header always unset X-Powered-By for PHP and other apps, then reload Apache and check a URL that doesn't exist.
How do I remove the IIS and ASP.NET version headers? On IIS 10, in web.config drops the Server header; drops X-Powered-By: ASP.NET ; drops X-AspNet-Version ; and MvcHandler.DisableMvcResponseHeader = true; in Application_Start drops X-AspNetMvc-Version . Older IIS versions need URL Rewrite or a proxy in front — and are usually past end of life anyway.
Is OpenSSL 1.1.1 still supported? OpenSSL 1.1.1 reached end of life on Sep 11, 2023, 1,137 days ago. OpenSSL 1.0.2 reached end of life on Dec 31, 2019, 2,487 days ago. Neither gets public fixes any more, so the checker grades an upstream build F once it is more than two years past end of life. Distribution builds (Ubuntu 20.04's 1.1.1f , Red Hat 8's 1.1.1k ) may still be patched by the vendor and are capped at C with a verify note. Move to a supported OpenSSL release.
Is jQuery 1.x or 2.x still safe to use? jQuery 1.x and 2.x are past end of life: their last releases, 1.12.4 and 2.2.4, shipped on May 20, 2016, and nothing has been fixed in them since. Both are affected by CVE-2020-11023, which CISA added to its Known Exploited Vulnerabilities catalog in January 2025. Whether your page is exposed depends on how it uses jQuery, so the checker caps them at C — but the upgrade path is well trodden: jQuery 4.0.0 with the jQuery Migrate plugin to catch what breaks.
Is this scan safe and legal to run? It sends the same plain GET request a browser sends, once, from a signed WatchForBot probe, and reads what any visitor receives. It never downloads the scripts, guesses paths, sends exploit payloads or anything malformed. Only check sites you own or are allowed to test — the result can name weaknesses, and it is meant for the people who can fix them.
Why did I get no grade? Because there was nothing to read: the page did not answer from our location, or a bot challenge or firewall page answered instead of your site (its headers are the CDN's, not yours). That is never a verdict on the site. If nothing in the response names a version, you get an A+ — with the honest note that we can only see what the page shows, so check the servers' patch levels directly too.
How is the grade worked out? It starts at A+ and each finding can only cap it. F: an exact server, runtime or CMS version in the range of a known-exploited CVE or one scored 9.0 or higher, a long-lifecycle product (PHP, OpenSSL, Apache httpd, Tomcat, IIS, Drupal, Joomla) more than two years past end of life, or PHP graded F by the PHP Version Checker. D: server or CMS software past end of life (nginx at worst D) or in the range of a high-severity CVE, or an inferred version that would otherwise be F. C: a distribution build that would otherwise be D or F, or a front-end library with a known-exploited, critical or high-severity CVE or past end of life. B: anything behind its latest patch release or losing support within 180 days, a medium-severity CVE, or 3 or more distinct versions revealed (the same version in two places counts once). A: any version shown at all (front-end library URLs don't count, and a major version alone such as Apache/2 is only a note). The full rules and the rubric version are under the tool and on the [WatchFor Grade](/grades#software-exposure) page; the [guide](/blog/what-your-server-headers-reveal) shows how to hide versions per server.
## Related web tools
- [PHP Version CheckerCheck your PHP version, EOL date and known CVEs — php2shell (CVE-2026-109618, CVE-2026-109619) first — from the headers your server already sends. Graded A+ to F, with the exact version to upgrade to. Passive: plain GET requests only, no signup.](/php-version-checker)
- [MCP Server CheckerTest a Model Context Protocol server the way an agent does — initialize handshake, protocol version, HTTPS, sign-in discovery and the full tool inventory — and get an A+ to F grade with the exact fix for every problem. Open servers are never marked down for being open.](/mcp-server-checker)
- [SSL Certificate CheckInspect certificate validity, expiry, SANs, issuer and chain trust.](/ssl-checker)
- [SSL/TLS GradeGrade a server's TLS config A+ to F — protocols, ciphers, forward secrecy, post-quantum, HSTS and certificate, with the exact reasons.](/ssl-grade-checker)
---
Canonical page: https://watchfor.io/software-exposure-checker · Site guide: https://watchfor.io/llms.txt