Vulnerability monitoring

Know when your sites run outdated or vulnerable software

Old PHP and an outdated WordPress are among the most common ways sites get hacked. Every day we read the software each of your sites shows and list what needs an update, with the version to update to.

Start monitoring free No credit card.

Example · example.com

3 problems found on example.com

Web server: nginx 1.18.0
Known vulnerabilities in nginx 1.18.0: 21, the worst rated high (CVE-2026-27654, CVE-2026-60005, CVE-2026-42945).
Language: PHP 8.1.2
PHP 8.1 stopped getting security fixes on 31 Dec 2025. Ask your host to switch to PHP 8.2 or newer. Known vulnerabilities in PHP 8.1.2: 42, the worst rated critical (CVE-2022-37454, CVE-2024-4577, CVE-2024-11236). Updating to 8.1.34 or newer fixes them.
CMS: WordPress 6.4.3
Known vulnerabilities in WordPress 6.4.3: 49, the worst rated high (CVE-2026-93485, EUVD-2026-82657, CVE-2024-31111). Updating to 7.1.4 or newer fixes them.
JavaScript library: jQuery 3.7.1
Analytics: Google Analytics

Live right now

27,977sites monitored

30,514,176checks in the last 24 hours

6check locations

60days of history

Vulnerability monitoring

The tech stack of every site

Web server, PHP, CMS, shop, plugins, framework, CDN, hosting, cache, security plugins and analytics, read from the response headers and the page.

Known vulnerabilities (CVEs)

For PHP, Apache, nginx and WordPress we look up the CVEs that affect the exact version, with the worst severity and the version that fixes them.

End of support

PHP that no longer gets security fixes or loses them within four months, WordPress older than the current release, and jQuery older than 3.5.

On the monitor page and in the API

Each site's software is shown under Reputation on its monitor page and returned as "technology" by the monitors API.

How it works

Create an accountPick a username; it becomes your status page address.
Add your sitesPaste a list or import from your panel or DNS provider.
RelaxWe check every minute and tell you the moment something is really down.

Questions

Do I need to install anything?

No. We read only what every visitor gets: the response headers and the page. Every monitored website is checked once a day.

Why is a version missing?

Many servers hide their version numbers, which is good practice. We only report what the site itself shows.

My server is Ubuntu or Debian. Is it really vulnerable?

Not always. Ubuntu, Debian and Red Hat backport security fixes without changing the version number, so the list is a hint there; check that the system packages are up to date.

Do I get an alert?

No, outdated software is listed on the monitor page and in the API, not sent as an alert. Blocklist listings and signs of a hack do send one.

Read the docs →

Start monitoring in a minute

Unlimited monitors, free. No credit card.

Create your free account