This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Software currency
What do plugin versions in your website's source code reveal?
Plugin versions in the source code reveal to any viewer which extensions your website uses and how old they are. Extensions — called "plugins" and "themes" in WordPress — retrofit functionality: contact forms, image galleries, shop integrations. Their file paths often carry a version value like "?ver=5.8". The Software Currency audit area reads these values from the delivered page and reports them as a finding.
Version values in file paths serve cache control
Browsers remember a website's files so it loads faster on the next visit. To make sure the new file actually arrives after an update, many systems append the version number to the file path — the browser sees a new path and loads it fresh. This is common and technically sound. The side effect: the version number thereby sits openly in the source code. This audit area therefore treats it as a minor finding worth 20 of 100 points — considerably lighter than a library with no maker maintenance. What gets reported is which extensions reveal their version, along with the exact locations, so your agency can check specifically.
Visible extension versions show strangers your maintenance state
Anyone reading your page's source code sees, with visible version values, at a glance which extensions are installed and how old they are — with no login, no tools, no trace left behind. Outdated extensions can be spotted from outside this way. The same clean distinction applies here: the check establishes visibility, not vulnerability. An old version number doesn't prove something is exploitable. But extensions come from many different makers and are maintained to varying standards — which is exactly why it's worth looking specifically at the extensions whose version anyone can see. The finding is a prioritised work list for the next maintenance round.
The check reads only what your page itself delivers
This audit area recognises extensions by the typical path patterns of common systems: WordPress plugins and themes, Joomla and PrestaShop modules, TYPO3 extensions, Drupal modules. It follows exclusively links present in the delivered source code. It doesn't try addresses, doesn't search for hidden files, and reports nothing it has no evidence for. This also produces the honest lower bound: from outside, only ever part of the installed extensions is detectable. An empty finding means "nothing detected", never "everything current". Only your website's admin area knows the complete list of your extensions — ask for it.
- Ask your agency for a list of all installed extensions along with the date of their last update.
- Have extensions removed that nobody needs any more — every installed extension is maintenance work.
- Check the extensions whose version is visible in the source code first: anyone outside can check exactly these for how current they are.
- Agree on regular update windows, so updates don't get left undone.
- For important extensions, ask whether the maker is still actively developing them.
FAQ
What is a plugin?
A plugin is additional software that extends a content management system with a function — a contact form, an image gallery, or appointment booking, say. Themes determine the website's appearance. Both often come from different makers than the system itself, and need their own updates. The more extensions are installed, the more maintenance the website needs.
Why does "?ver=" appear after files on my website?
That's a version value for cache control: browsers cache files, and the version suffix makes sure the new file loads after an update. The mechanism is common and sensible. Its side effect is disclosure: anyone can read from these values which extensions are in use, and in what version.
Are visible plugin versions a security problem?
They're a pointer, not proof of a hole. The check assesses the visibility of versions, not their vulnerability — whether a specific extension is exploitable can't be responsibly determined from outside. Visible versions do let anyone spot outdated extensions, though. That's exactly why these extensions belong at the top of the update list.
How many plugins should a website have?
As few as necessary. There's no fixed number — what matters is that every installed extension is needed, maintained, and updated. Forgotten extensions are the real problem: they keep running unnoticed and get no updates. An annual review asking "Do we still need this?" keeps the list short.