Software currency: what exactly is checked

Rule set software-v1, purely passive. Every subtopic leads to its checkpoints with weight and explanation; the list comes from the audit engine itself.

• 

  Libraries

  Integrated libraries with manufacturer maintenance instead of with maintenance end.

  1 article

• 

  Versions are hidden

  CMS, plugin and server versions are not in the source code and not in the headers.

  3 articles

• 

  Valid HTML

  The source code passes W3C validation; Browsers don’t have to guess anything.

  1 article

What is measured

This audit area rates from findings and measured values, not from a countable set of rules. That is why this page lists which signals are collected.

• Detected system

  Which CMS or shop system is delivered and whether a version is visible to the outside – read from generator data, paths and headers.

• Extensions

  Recognizable plugins and themes including version, as far as they result from the loaded files.

• Libraries without producer maintenance

  Built-in front-end libraries that the manufacturer has discontinued maintenance — compared to the published end-oflife.date. Recognized from script paths and, where the library is bundled, from the version details it reveals at runtime. A proven fact, not a statement of vulnerability.

• Visible versions in headers

  Version specifications in HTTP responses. They are not a hole, but they facilitate mass attribution.

• Purely passive

  No scan, no login attempt, no additional retrieval – only what the page delivers anyway is evaluated.

To the service page “Software currency” →