The advisory was published three days ago
Your monitoring already downloads every page, and those pages say which versions the site runs. Crossing that with public advisories moves the work from after the incident to before it.
Two signals that are never merged
This is the decision the whole feature rests on, and getting it wrong is how security alerts end up filtered into a folder nobody opens. Two different things are reported, with two different words, because they demand two different amounts of urgency.
| Signal | What it means exactly | What you get with it |
|---|---|---|
| Published flaw | A named advisory covers precisely the version detected. Nothing is inferred. | The identifier and the link, so you read the advisory rather than trust us. |
| Behind the current release | A newer version exists. This is a debt, not a danger, and it is said differently. | The two version numbers, and no urgency attached to them. |
Announcing "vulnerable" when all you know is "not current" would make every alert here worth ignoring inside a week, and the one that mattered would go with them. The separation is not caution, it is what keeps the signal usable.
The distinction is written at the top of src/Vuln.php, read on 3 August 2026, with the two advisory sources it queries.
The inventory is a by-product
Nothing here is scanned. The availability check has already downloaded the page, and the page carries the answers: a generator tag names the CMS and its version, plugins version the files they load, a theme states its own in a stylesheet header. Reading them costs one pass over text already in memory.
That is why there is no agent to install and nothing to keep updated on your servers, and it is also the limit of the method. A site that strips its generator tag and versions its assets by hash shows nothing, and the report for it says that nothing was detected rather than pretending nothing was found.
Where the others land on this
Uptime tools do not generally do this at all, and the ones that offer something adjacent sell it as a separate product. A dedicated security scanner will go far deeper than reading a page: it will probe, log in, and test. If that is what you need, buy that, and this will not replace it.
What this does instead is answer one narrow question across an entire estate, every day, at no extra cost per site: does anything you look after run a version somebody has published an advisory about. That question is usually answered by nobody, which is why it is answered late.
Questions about watching versions from outside
How do you know which version a site runs without access to it?
The pages say so. A CMS leaves its version in a generator tag, its plugins leave theirs in the query string of the files they load, and a theme leaves its own in a stylesheet header. None of that requires a login, an agent or a scan: it is read from the HTML that the availability check has already downloaded, which is also why it costs no extra request.
What is the difference between a published flaw and an out-of-date version?
Everything, and confusing them is how this kind of feature becomes noise. A published flaw means a named advisory covers precisely the version detected, and you get the identifier and the link. Out of date means a newer release exists, which is a debt rather than a danger. Calling the second one "vulnerable" would make every alert here worth ignoring within a week.
Where do the advisories come from?
OSV.dev for what is published through Packagist, which covers Drupal, Laravel, Symfony, TYPO3, Magento, PrestaShop and Joomla, and api.wordpress.org for the current version of the WordPress core, its plugins and its themes. Both are public, both are quotable, and neither is us.
Does reading versions from the HTML not miss a site that hides them?
It does, and that is worth saying plainly. A site that strips its generator tag and versions its assets by hash will show nothing, and the honest report for it is that nothing was detected rather than that nothing was found. An agent installed on the server would see more; it would also be an agent to install on every server, which is the trade this product declines.
Is a hundred sites not a hundred requests a day to those services?
No. The question is asked once per component and per version, then cached for a week, and the number of lookups per maintenance pass is capped. A version that has not changed is not asked about again, and most of an estate does not change on most days.
See what a page says about itself
The free check reads the page the same way, and tells you what a status code was covering for. One address, no account.