Back to scan results
What this check probes
We extract version strings from:
Server response header — Apache/2.4.41, nginx/1.16.1, Microsoft-IIS/8.5, LiteSpeed.X-Powered-By response header — PHP/7.2.10, ASP.NET, Express.X-AspNet-Version — ASP.NET version disclosure.- OpenSSL versions when included in HTTP software banners.
The scanner uses bounded legacy-version patterns and a maintained snapshot of selected official nginx advisory ranges, including fixed stable branches. It does not download a complete CVE database on each scan or exploit memory-corruption, mail or denial-of-service vulnerabilities.
Version-only findings are orange warnings requiring review before relying on a passed pre-scan. Check the installed package revision, enabled modules and vendor patch records. Hiding the version does not fix a vulnerability, and a version outside this limited snapshot does not prove that all security updates are installed.
Why this matters for PCI DSS
PCI DSS 4.0 Requirement 6.3.3: "All system components are protected from known vulnerabilities by installing applicable security patches/updates" — critical patches within one month of release.
Requirement 11.3.1 requires internal vulnerability scans every three months. Requirement 11.3.2 requires external scans by an Approved Scanning Vendor (ASV) every three months. Both will fail you on a missed CVE patch.
A version banner is just the easy way to spot the problem from outside. The real issue is the unpatched code; hiding the banner without patching is security theatre.
How to fix it
Patch first. Use the vendor's supported security updates and verify that the relevant advisory is addressed in your installed build.
- Ubuntu / Debian — enable unattended-upgrades for security:
sudo apt install unattended-upgrades, then sudo dpkg-reconfigure unattended-upgrades.
- RHEL / CentOS / Rocky — install
dnf-automatic, configure /etc/dnf/automatic.conf with upgrade_type = security and apply_updates = yes.
- Windows Server — Windows Update for Business or WSUS, configured to install critical/security within the patch SLA.
- WordPress / Drupal / Joomla — enable automatic minor-version core updates, and use a managed host (Pantheon, Kinsta, WP Engine) if patching is not your core competence.
- PHP / Node / Python runtimes — pin to a still-supported major version and follow the upstream release schedule.
Then hide the version banner as a secondary measure (covered in Check 4):
# nginx
server_tokens off;
# Apache
ServerTokens Prod
ServerSignature Off
# PHP
expose_php = Off
# WordPress: install a security plugin or filter:
add_filter('the_generator', '__return_empty_string');