SEC-051
Software version no longer receives security fixes
Last reviewed
What it checks
Exact versions of nginx, Apache HTTP Server, OpenSSL and Jetty in the Server and X-Powered-By headers, and of WordPress and Drupal in the generator tag, against the release lines on endoflife.date (fetched 2026-10-28). Distribution builds (packaging suffixes, or a Server header naming Debian, Ubuntu, Red Hat and similar) are skipped because they backport fixes. Hidden versions are not judged.
Why it matters
Once a release line ends, newly found vulnerabilities in it are never fixed. Attackers look up the disclosed version and try every flaw published since.
Recommended fix
Upgrade to a supported release line (see the latest release in the evidence), then stop advertising the exact version (server_tokens off; ServerTokens Prod; remove the generator tag).
How to verify
Check the Server header and generator tag after the upgrade, then rescan.
Example fix prompt
Please fix this production issue in my app.
Issue SEC-051: Software version no longer receives security fixes
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: The site advertises software whose release line has reached end of life (see the evidence for the product, version and date). Upgrade it to a supported release line on the server or hosting plan, restart it, and confirm the site still works. Then hide the version: nginx server_tokens off; Apache ServerTokens Prod and ServerSignature Off; for WordPress or Drupal, remove the generator meta tag.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Check the Server header and generator tag after the upgrade, then rescan.