This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Passive detection: not a single additional request
Software Currency is determined entirely from HTML already fetched and its associated headers. It triggers not a single additional request — for the server being checked, this check point is free.
- This is a deliberate design decision: a check point that probes paths to detect a system would be a scan. That's exactly what the audit rules' passivity guarantee excludes.
- The price for that is imprecision. Systems that leave no traces in the delivered HTML don't get detected — and the report says so, instead of claiming a detection.
- Content management and shop systems, forums, learning platforms, wikis, website builders, and application frameworks get detected. Identification happens via traits in the delivered code, not via probing.
FAQ
Why doesn't the check search for known paths?
Because that would be a scan. The audit rules explicitly exclude vulnerability and port checks — and an audit service that probes access points becomes a risk itself.
Does the check put load on our server?
Not at all, for this check point. It evaluates what was fetched for the other audit areas anyway.