Check 48 of 54 · Attack surface
Out-of-date server software announced by your other hosts, such as a mail, VPN or remote-access server.
Engine 1.57.0, read 25 October 2026
What have you left open to the internet?
The homepage of each subdomain the sweep finds, asked once, as a browser asks. Its Server and X-Powered-By headers are read as the server banner check reads yours: an out-of-date version of nginx, Apache, PHP or OpenSSL fails. One such host costs 15 points and each more 4, up to 30.
A version number in a banner tells an attacker which published flaws to try, on a host that is often less watched than your website, and a remote-access or mail host is a way into the office network.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Only nginx, Apache, PHP and OpenSSL can be called out of date, as on the server banner check, and a version that is not out of date is named without a charge. No other page is requested and no port is scanned, on at most 30 subdomains. A host that does not answer is named as not read.
It reads up to 30 of your other hosts, which is more than a check of a domain that is not yet a customer should ask, so it runs on a customer's own verified domains, not on the free check.
Check 48 is one of 5 in Attack surface. See it in its row on the scanner page, beside the rest of Attack surface.
This check runs on a customer's own verified domains. The free check runs over 40 checks in about 30 seconds, with no account.