This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Software currency
Why should your website hide its CMS version?
A publicly visible CMS version makes your website sortable for attackers: anyone searching en masse for pages with a specific version finds your page with no effort at all. The CMS is the content management system your content is maintained with — WordPress, Joomla, or TYPO3, say. The Software Currency audit area reads your page's source code and response, and reports if the version number is there.
Your homepage's source code often names the system, version included
Every website, alongside its visible content, delivers source code any visitor can open in their browser. Many content management systems write a kind of business card into it, the so-called generator tag — the system name along with its version number, say. File paths can carry the version too. For running the website, this value is irrelevant; it's a leftover of the default setting. This audit area recognises common systems like WordPress, Joomla, Drupal, TYPO3, or shop systems like Magento, Shopware, and PrestaShop by their typical traces in the source code, and checks whether the version is delivered along with them. Every finding names the exact location, so your agency can trace it.
A visible version is reconnaissance aid for attackers
Attacks on websites rarely happen by hand. Programs comb the web and sort pages by system and version. If your version is openly readable, your website lands on the matching list with no further effort on anyone's part. The distinction matters: the check establishes that the version is visible — never that your installation is vulnerable. It can't know that from outside, and it doesn't claim to. Visibility is still an avoidable gift to the other side, though. Removing the value doesn't replace an update, but it does shrink the attack surface. In the assessment, the hidden system version counts for 20 of 100 points.
With website-builder providers, the provider handles maintenance
Websites on Wix, Shopify, Squarespace, Webflow, or Jimdo run on platforms the provider keeps current themselves. For pages like this, this audit area doesn't treat a recognisable origin as a finding — "outdated version" isn't a meaningful category there, since you don't have to install updates. It's different for self-run systems like WordPress, Joomla, or TYPO3: here, you or your agency are responsible for updates, and that's exactly why version visibility counts here too. If you're unsure which group your website belongs to, the finding report answers that too — it names the system detected and its evidence.
- Open your homepage's source code (right-click, "View page source") and search for the word "generator".
- Ask your agency to switch off the generator tag — in common systems, that's a small, risk-free change.
- Clarify in writing who is responsible for updating your content management system — you, the agency, or the hosting provider.
- Have installed updates briefly confirmed to you, so maintenance stays verifiable.
- Treat hiding it as a bonus: the actual protection measure remains ongoing updates.
FAQ
How does a website check know what CMS I use?
From what your page delivers to every visitor anyway: source code, file paths, and response headers carry typical traces of the system. The check reads only this delivery. It doesn't try secret paths, doesn't attempt to log in, and runs no attacks — it's a passive, technical examination of what's publicly visible.
Is a visible CMS version dangerous?
It's a reconnaissance aid, not a security hole itself. Attackers can use the version number to specifically search for matching weaknesses, without having to examine your website themselves. The visible version doesn't say whether your installation is actually vulnerable — and the check doesn't claim that either. Hiding it shrinks the attack surface, but doesn't replace an update.
How do I hide my content management system's version?
In common systems, the generator tag can be switched off or removed, usually with no effect on the website at all. This step belongs in your agency's or administrator's hands, and is done quickly. What matters is the order: secure the update first, then hide the version — not the other way around.
Do I need to worry about updates on Wix or Shopify?
Not about the platform itself — the provider updates it centrally for all customers. That's why this audit area doesn't treat a recognisable website-builder origin as a finding. Your responsibility stays with the content and anything you embed yourself, third-party scripts or extra features from the provider's app catalogue, say.