Outdated software

What we check

We collect all version details that the website reveals:

• in the responses of the server, such as Server: Apache/2.4.29 or X-Powered-By: PHP/7.4.3,
• in the code of the page, such as the WordPress version in the generator meta tag,
• through our technology detection in the browser, such as jQuery, Bootstrap, React, TYPO3 or Shopware.

We compare these versions with the vendors' support data on endoflife.date:

• No longer supported: serious defect, whether server, programming language, CMS or a component in the browser (e.g. Bootstrap, React, Vue). Known vulnerabilities are no longer fixed.
• Still supported, but not up to date: warning with the current version.
• Versions publicly visible: warning, even if they are current, because they make targeted attacks easier.

Why it matters

All software has bugs, and some of them are security vulnerabilities. As long as a version is supported, the vendor closes them with updates. After that, no longer: every newly discovered vulnerability stays open for good.

Attackers work automatically. Programs search the internet around the clock for servers that report certain outdated versions and attack them with ready-made tools. This takes no particular interest in the company. The consequences range from spam being sent through the server to data leaks and a website that infects visitors with malware.

Common candidates are old PHP versions such as 7.4 or 8.0, which have not received updates for years, WordPress installations that have not been updated, and CMS versions that the agency set up years ago and never touched.

Anyone who discloses which version is running also makes the search easy for attackers.

How to fix it

Server and PHP

With shared hosting you usually choose the PHP version yourself in the customer panel. Choose the newest version that the CMS supports and test the website afterwards. With a dedicated server the operating system must be updated. That is the task of the hosting provider or agency.

CMS

You update WordPress, Joomla, TYPO3 and others in the backend. If a change of major version is due, for example from TYPO3 10 to 12, the agency is usually needed, because extensions have to be adapted. Schedule such updates firmly, much like the service for a company vehicle.

Hide version details

This does not replace updates, but makes targeted attacks harder:

• Apache: ServerTokens Prod and ServerSignature Off
• nginx: server_tokens off;
• PHP: expose_php = Off in the php.ini
• WordPress: security plugins remove the generator meta tag.

How to check it yourself

In WordPress "Tools › Site Health" shows the PHP version and whether it is outdated. On endoflife.date you can look up for every piece of software until when a version is supported.

Frequently asked questions

The hosting provider says the server is up to date. Who is right?

Possibly both. Some providers apply security fixes without changing the version number. The version information is therefore a pointer. It is worth asking whether the version named still receives security updates.

What does "End of Life" mean?

The vendor has ended support for this version. Newly discovered security vulnerabilities are no longer closed, not even for payment.