This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Extensions and their versions: the bigger attack surface
Extensions usually reveal their version through the file path of the loaded stylesheets and scripts. The check reads it there, and reports when versions are publicly detectable — including the exact evidence location.
- In practice, extensions are the bigger field than the system itself: they come from many different vendors, are maintained to varying standards, and get forgotten more easily.
- The report lists the detected extensions along with their version. This list is useful even when there's nothing to flag — it shows what's actually running, and experience shows that differs from expectations.
- Only what leaves traces in the delivered HTML gets detected. An extension that works purely in the background doesn't show up — the report therefore doesn't claim completeness.
FAQ
Does the check detect every extension?
No, only the ones that become visible in the delivered HTML. The report says so explicitly, instead of claiming a complete inventory.
How do I hide version values in file paths?
Via the system's settings, or a web server rule that strips the version parameter. Note that caching then needs to be controlled differently.