Check 23 of 54 · Web and TLS
Whether your server announces its software and version: a shopping list for attackers.
Engine 1.57.0, read 25 October 2026
Is your website set up safely?
The Server and X-Powered-By headers, for any software version they name. An out-of-date version of nginx, Apache, PHP or OpenSSL fails, and any other version warns, Microsoft-IIS/10.0 among them. Ubuntu, Debian, SUSE, Amazon Linux and the Red Hat family fix security bugs without changing the version number, so a banner naming one only warns. The banners AWS's load balancer and Azure Storage put on their own responses are not counted: they name the platform's software, not yours.
A version number tells an attacker which known exploits to try.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
"Out of date" is as current as our last review of each product's fixed releases, and an end of support the vendor has announced applies on its day. Only nginx, Apache, PHP and OpenSSL can be called out of date. Where the headers name no distribution, a version is judged on its number alone, even if a distribution patched it.
Check 23 is one of 15 in Web and TLS. See it in its row on the scanner page, beside the rest of Web and TLS.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.