This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
The system's version number: why it doesn't belong on public display
Many systems state their version number unprompted — in a generator meta tag, in file paths, or in a header. The check establishes whether such a value is visible from outside.
- Hiding it isn't a security measure in the strict sense — it closes no hole. But it removes the basis for mass, automated matching: anyone specifically searching for a particular version then won't find your installation through a simple query.
- The effort is small: in most systems, one setting or one line of configuration is enough. What matters is catching every spot — removing the meta tag while leaving the version in the file path achieves nothing.
- This point deliberately carries only 20 of 100 points. It's reconnaissance aid for attackers, not a shortcoming on its own.
FAQ
Isn't that security through obscurity?
Partly, yes — and that's exactly why this point weighs little. It doesn't replace an update, but it lowers the odds of ending up on an automated target list.
Where does the version typically appear?
In the generator meta tag, as a parameter on stylesheets and scripts, and occasionally in a response header. The report names the exact location.