Discuss your project

TOOLBOX · SECURITY CHECK

What Does Your Website Reveal?

Web servers, CMS and extensions often name themselves and their version unasked. Enter a domain and see what your home page reveals and which line switches it off.

The bot check protects the toolbox against automated abuse.

We fetch the page once, like a browser, and read the headers and HTML. We do not guess paths. We do not store results permanently.

WHAT IS CHECKED

Headers and HTML.
Nothing More.

Anyone who wants to attack a website first looks at which software runs behind it. The OWASP testing guides proceed exactly like this: first identify the web server (WSTG-INFO-02), then the framework (WSTG-INFO-08). The detection is a heuristic; every finding names the place where it appears.

  • 01

    Server Header

    Does it only name “nginx” or “Apache/2.4.41 (Ubuntu)” including the operating system? The product name alone is harmless.

  • 02

    X-Powered-By

    Reveals the language or framework, often with a version, such as PHP/8.1. The header is of no use to visitors.

  • 03

    ASP.NET and Other Headers

    X-AspNet-Version, X-AspNetMvc-Version, X-Generator, X-Pingback and proxy details with versions.

  • 04

    meta generator

    CMS and page builders write their name and version into every page, such as WordPress, Elementor or TYPO3.

  • 05

    Versions in Addresses

    ?ver=6.4.2, bootstrap@5.3.0 or jquery-3.5.1.min.js show the release of embedded libraries.

  • 06

    Comments and Platform

    HTML comments from extensions with version numbers, plus paths and cookie names that reveal the platform.

HOW TO SWITCH IT OFF

One Line
per Place.

Then check again. More important than any of these lines remains regulated patch management; the glossary explains more about securing servers under system hardening.

  • nginx and Apache

    server_tokens off removes the version from the Server header and the error pages in nginx. ServerTokens Prod leaves only the product name in Apache; ServerSignature Off removes the footer of error pages.

    # nginx (http block)
server_tokens off;

# Apache (main configuration)
ServerTokens Prod
ServerSignature Off

    Source: nginx documentation

  • IIS and ASP.NET

    removeServerHeader exists from IIS 10.0 on Windows Server or Windows 10, each version 1709. enableVersionHeader switches off the ASP.NET version header.

    <!-- web.config: Server header (IIS 10.0 from version 1709) -->
<system.webServer>
  <security>
    <requestFiltering removeServerHeader="true" />
  </security>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>
<system.web>
  <httpRuntime enableVersionHeader="false" />
</system.web>

    Source: Microsoft Learn

  • PHP, Express, Next.js

    expose_php controls the X-Powered-By header of PHP and can only be changed in php.ini. Express and Next.js also send X-Powered-By on their own.

    ; PHP (php.ini)
expose_php = Off

// Express
app.disable('x-powered-by');

// Next.js (next.config.js)
module.exports = { poweredByHeader: false };

    Source: PHP manual

  • WordPress

    The the_generator filter controls the generator meta element. Page builders and SEO extensions often set entries of their own, which can be switched off in their settings.

    // WordPress: remove meta generator
add_filter('the_generator', '__return_empty_string');

    Source: WordPress Developer Resources

LIMITS OF THE CHECK

Visible Does Not Mean
Vulnerable.

The check shows what your website reveals. It deliberately does not answer whether a version has a known vulnerability.

  • No mapping to vulnerabilities (CVE): distributions bring fixes into older versions, so the number alone is misleading.
  • Only the page entered: no guessed paths, no subpages, no embedded files.
  • Heuristic: a number after ?ver= can also be a version number of the theme itself.
  • Without JavaScript: the check does not see what scripts only load in the browser.

Keeping an eye on the patch level of your systems is the task of vulnerability management; the glossary explains what a CVE number means and why outdated PHP versions are a risk (PHP end of life). Headers such as HSTS or the Content-Security-Policy are rated by the security header check.

QUESTIONS

Good to Know.

Does hiding versions make my website more secure?

Only a little. The Apache documentation states clearly that switching off the version detail does not make a server more secure; OWASP speaks of security through obscurity that only slows down the simplest automated searches (WSTG-INFO-08). What matters is that the web server, CMS and extensions are up to date. Because switching it off usually takes one line and makes it harder for scanners to preselect targets, we still recommend it.

Why does the check not say whether my version has a vulnerability?

Because the version number is not reliable for that. Distributions such as Red Hat Enterprise Linux bring security fixes into older versions (backporting); tools that only compare the number then report gaps that were closed long ago. Whether a system is vulnerable only shows from its actual patch level, for example as part of vulnerability management.

Where does the ?ver= in my addresses come from?

WordPress automatically appends the installed WordPress version to scripts and stylesheets that are embedded without a version of their own (parameter $ver of wp_enqueue_script and wp_enqueue_style). Extensions often use their own version number for this. This way browsers load the new file after an update; the side effect is that the release is visible in the source code.

Which addresses does the check fetch?

Only the page entered, usually the home page, once with GET like a browser, at most 1 MB. It does not guess paths such as /wp-admin/ or /readme.html and does not fetch embedded files; everything it shows is in the response of this one page.

Does TOMORIS store my input or the result?

No, not permanently. Our server fetches the page once; the website checked sees our server, not your IP address. The result stays in memory for five minutes so that repeated requests do not put load on the website again, and it is deleted after six minutes at the latest. Details are in the privacy statement.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result