How the recent advisories check works
New security flaws are published every day. For the software that small websites run most often, such as WordPress, PHP, Apache and nginx, we follow the public sources: the CISA list of flaws known to be exploited, the GitHub Advisory Database and the US National Vulnerability Database. When a serious one appears, we publish a short page about it on our security advisories list.
From the moment that page is published, every new check compares your site with it. You do not have to do anything to get the newest flaws into your report.
What we compare
The check reads only what the technology check has already found: which software your site shows, and which version, from a response header, a generator tag or the address of a script. It sends nothing to your site for this.
For each published advisory about software we saw on your site, we compare the version with the releases that fix the flaw.
The three outcomes
- Potentially affected. The version your site shows is older than the release that fixes the flaw on its branch. We never say "affected" from a version number alone, because many hosts install fixes without changing the version number. Ask whoever runs your site to confirm.
- Cannot tell. We can see the software, but your site does not show its version. Hiding the version is good practice; it only means someone with access to the server has to confirm the fix is installed. All open advisories for that software are listed in one line.
- No finding. The version is at or above the fixed release, or the software is not on your site.
Flaws that are big enough to be in the news get a fuller page on the wave radar and their own check; they are not repeated here.
Severity
The rating comes from the advisory's own sources: critical stays Critical, high becomes Serious, and a flaw that CISA lists as exploited counts at least as Serious. A "cannot tell" result is Info and does not lower your score. The methodology page has the scoring formula.
Everything this check can report
- CriticalVersion below the fixed release of a critical published advisory
- SeriousVersion below the fixed release of a serious published advisory
- ModerateVersion below the fixed release of a published advisory
- InfoVersion hidden, recent advisories cannot be compared
Severity is fixed per finding in our code and never set by the AI that writes the report text. How severity becomes a score is on the methodology page.
The other checks
- How the security headers check works · The instructions your server sends to browsers with every page.
- How the cookies check works · Whether the cookies your site sets are protected on the way and in the browser.
- How the secure connection check works · Your certificate, the encryption your server accepts, and whether visitors are moved to https.
- How the email and DNS check works · The public DNS records that stop fake email in your name, and addresses pointing to services you no longer use.
- How the technology check works · What your site is built with, worked out from what it shows publicly.
- How the vulnerability wave check works · Whether what we can see matches a major vulnerability in the news.