Check your website for outdated software
Type the domain of your own site. We read the versions it already shows to every visitor and compare them with 97 published advisories, the same check that has run on 446,380 domains so far. Before verification you get one line: outdated versions found or not. Verify the domain and the full report opens with the fix.
Passive by design: we read only the public HTML and headers any browser receives. No test requests, no login attempts, nothing on your site is changed.
- Detected
- WordPress core 6.9.4
- Evidence
- Version string in /wp-includes/ asset URLs
- Affected
- >=6.9 <6.9.5; >=7.0 <7.0.2
- Fixed in
- 6.9.5 / 7.0.2
- Source
- NVD · 17 Jul 2026
How the check works
Three steps and one rule. The rule: without verification the check answers in one line, whether outdated versions were found. Which component, which version and which advisory open only after you prove the domain is yours.
We read what your site shows
Response headers, script and stylesheet URLs, generator tags: the public HTML and headers every visitor's browser already receives. No test requests. We respect robots.txt and fetch nothing that needs a login.
We compare versions with advisories
Every version we could read is checked against the affected ranges published in OSV and NVD, with CISA's KEV catalogue marking the urgent ones. A hit is a match, with the advisory's score and the version that fixes it.
Verify the domain, read the report
Sign up and prove the domain is yours: a TXT record in its DNS, a file at its root, or a confirmation sent to a role address at the domain such as admin@ or webmaster@. The report opens the moment the check passes: every finding, its evidence and the version to update to.
Who counts as the owner
Whoever can add a TXT record to the domain's DNS, put a file at its root, or confirm a link sent to a role address at the domain (admin@, webmaster@, security@). A TXT record on your-site.com covers its subdomains; a file covers that host only. We re-check from time to time: if the proof is gone, so is the access.
Cannot touch DNS or the files on the site, and no role address? Write to [email protected] and we will verify by hand.
Two answers, one next step
Without verification the answer is one line, whichever way it goes. Both lines lead to the same place: a verified domain we keep checking for you.
Outdated software found
That is all the answer says before verification: no count, no score, no advisory. Sign up, verify the domain, and the report opens with every finding and the version that fixes it.
Check my siteAll clear today
No open advisory matches the versions we could read, among the advisories we track, on the day we looked. Verify the domain anyway: we re-check it on every crawl and write to you the moment a new advisory matches.
Watch a domainWhat your report contains
One page per verified domain. Each finding with its evidence, what to do about it, and an honest list of what a passive read did and did not look at.
- ·A verdict: critical finding, no known critical issues, or insufficient data.
- ·The exact version we read and where on the site we read it.
- ·The advisory, its score, and the version that fixes it.
- ·What was checked and what was not. A clean report is not a security audit.
- Advisory
- CVE-2026-63030
- Evidence
- Version string in /wp-includes/ asset URLs
- Affected
- >=6.9 <6.9.5; >=7.0 <7.0.2
Update WordPress core to 6.9.5 / 7.0.2 or later. The release is a security release and is safe to apply on its own.
Checked
- Public technology fingerprint: headers, scripts, meta tags
- Detected versions against the advisories we track
- Public CMS plugin and theme inventory
Not checked
- Logged-in and authenticated areas
- Custom or in-house code
- Server configuration and infrastructure
- Software that does not expose a version at all
What this check is, and what it is not
The result is information about the software versions your site publishes, read from the outside. It is not a security audit and not a guarantee.
It is
- A read of the versions your site already exposes to every visitor.
- A comparison with published advisories: the CVE, its CVSS score, whether CISA lists it in KEV, and the version that fixes it.
- Free for the verified owner, with a re-check on every crawl for as long as the domain stays verified.
It is not
- A penetration test. No test requests are sent and nothing is changed.
- A full inventory. Software that hides its version cannot be checked, and custom code is never looked at.
- A clean bill of health. No match means no match among the advisories we track, on the day we looked.
Anyone can check a domain, and the answer is one line: outdated versions found or not. Details open only after ownership is verified; the rules we hold ourselves to are below.
What a CVE is, in four terms
The rest of this page uses these four words. A CVE is not a breach and not a verdict on your site. It is a public record that a specific version of a piece of software has a known flaw, and that a newer version fixes it.
- CVE
- Common Vulnerabilities and Exposures. A public identifier, such as CVE-2026-63030, for one known flaw in one piece of software. Each record names the affected versions and the version that fixes it. Anyone can look it up.
- CVSS score
- Severity from 0 to 10, set when the flaw is published. 9.0 and above is critical. 7.0 to 8.9 is high. This page counts only critical as critical.
- CISA KEV
- A catalogue kept by CISA, the US cyber-security agency, of advisories confirmed to be used in the wild. A KEV flag means the update should not wait.
- A match
- What this page means by "a site has a CVE": the version we read on the site falls inside the affected range an advisory publishes. It is a version comparison, not a test of the site. The fix is almost always an update.
Worked example: a site runs WordPress core 6.9.4. Advisory CVE-2026-63030 (CVSS 9.8) covers >=6.9 <6.9.5; >=7.0 <7.0.2. The version is inside that range, so the site is a match, and the report says to update to 6.9.5 / 7.0.2.
What we find most often
The advisories most often matched across all crawled sites, one row per advisory, sorted by the number of domains. A domain counts once per CVE and only when its version was read exactly or likely. These are totals only: no domain is named here or anywhere else on the site.
| CVE | Severity | Domains |
|---|---|---|
| CVE-2020-11023 | 6.9mediumCISA KEV | 29,706 |
| CVE-2019-11358 | 6.1medium | 27,195 |
| CVE-2015-9251 | 6.1medium | 22,145 |
| CVE-2020-11022 | 6.9medium | 14,689 |
| CVE-2012-6708 | 6.1medium | 6,615 |
| CVE-2020-7656 | 6.1medium | 6,601 |
| CVE-2019-8331 | 6.1medium | 2,416 |
| CVE-2026-60137 | 5.9mediumCISA KEV | 2,337 |
| CVE-2024-6485 | 6.4medium | 2,152 |
| CVE-2018-14042 | 6.1medium | 2,061 |
| CVE-2018-14040 | 6.1medium | 2,061 |
| CVE-2024-45771 | 9.8criticalCISA KEV | 1,855 |
Domains: open matches read exactly or likely. Exact reads: the subset where the full version string was observed directly.
1 CVE-2024-4577: Affects PHP-CGI on Windows only. The matcher does not check the platform yet, so this count is an upper bound.
Not in the table: Apache HTTP Server, 8,850 domains. Version read from the Server header only. Distributions such as Debian and RHEL back-port fixes without changing it, so a match is graded weak and never counted.
How a finding is made, and how far to trust it
Three steps, three grades, three sources. A version we could not read is not a finding; a match on a bare Server header is never counted; the precision figures come from a manual check and are printed with their sample size.
Crawl
We fetch public pages the way a browser does, respecting robots.txt, and keep the response headers, scripts, stylesheets and generator tags. No test requests.
Detect
Detectors name the software and read its version from asset paths, query strings, headers and file names. Each read gets a confidence grade.
Match
Every version is compared with the affected ranges in the advisories we track. A hit inside a range becomes an open match with the advisory's score and KEV flag.
Confidence grades
Precision from a manual review of 50 matches on 21 Sep 2026: for each, a person opened the site and checked whether the version was really there.
- exact
- The full version string was observed directly: a WordPress core version in /wp-includes/ asset URLs, a plugin's ?ver= parameter, a library file name.
- 94% precise19,783 open matches
- likely
- The version was inferred from several agreeing signals, or a truncated string was extended by the most common release, such as PHP/8.2 to a known 8.2.x.
- 100% precise114,829 open matches
- weak
- A single source that vendors and distributions routinely leave stale, such as the Server header. Distribution back-ports make it unreliable.
- 50% precise15,152 open matches
Advisory sources
- OSVOpen Source Vulnerabilities: version ranges for open-source packages, including WordPress plugins and JavaScript libraries.
- NVDThe National Vulnerability Database: CVSS scores and affected products for the CVEs we track.
- CISA KEVCISA's catalogue of advisories confirmed to be used in the wild. Sets the KEV flag on a match.
97 advisories in the registry, refreshed every night at 04:30 UTC. Every match is re-evaluated when the domain is crawled again.
Rules we hold ourselves to
Five rules you can hold us to. The privacy policy is the binding text.
- 01We only read what is publicThe public HTML and headers any browser receives. No test requests, no login attempts, nothing beyond a normal page visit.
- 02Without verification, one lineOutdated versions found, none found, or not enough data. No count, no score, no CVE: details about a site belong to whoever runs it.
- 03Details after verification onlyA DNS TXT record, a file at the root, or a link confirmed from a role address proves the domain. The findings, the evidence and the fix are shown to that account and to nobody else. The API follows the same rule.
- 04Alerts only for your own domainsAn email to the account that verified the domain when a new advisory matches or a match is resolved. Nothing else, and nothing about domains you have not verified.
- 05One click and we stopEvery email carries a one-click unsubscribe. Remove the domain from your account and we stop checking it for you; anyone running a site can exclude it from crawling too.
Keep your site checked
A free account watches three verified domains. We re-check them on every crawl and email you the moment a new advisory matches one of your versions, with the version that fixes it, or when a match is resolved.
Free: three verified domains, full profiles, one list. No card.
The same report, over HTTP
One GET returns the report for a verified domain as JSON: verdict, findings, technologies and coverage. For any other domain the same call answers with the public one line. Wire it into your own monitoring or an agent.
GET https://api.datacrawly.io/v1/public/reports/{domain}