Outdated JavaScript libraries and version leaks: what to fix first

Last reviewed

Attackers rarely find brand-new weaknesses. They look for sites running old versions of software with problems that were published long ago.

Two things make that easy: running old components, and announcing exactly which versions you run.

Check your own site for this in about a minute

A script library on your pages has known weaknesses

What it is. Your pages load a version of jQuery older than 3.5.0.

Why it matters. Older versions have published weaknesses that can let injected content run in visitors’ browsers.

Time to fix. About 30 minutes

Any host

Update your theme and plugins (WordPress: Dashboard > Updates).
If you load jQuery yourself, switch to version 3.5.0 or later and re-test your pages.

Scripts from other sites run without a safety check

What it is. Your pages load scripts from other websites without an integrity hash (Subresource Integrity).

Why it matters. If that other site is hacked, the attacker’s code runs on your pages too, with full access to your visitors.

Time to fix. About 30 minutes

Any host

For fixed-version scripts from CDNs, add the integrity and crossorigin attributes the CDN provides, e.g.:
<script src="https://cdn.example.com/lib@1.2.3/lib.min.js"
        integrity="sha384-..." crossorigin="anonymous"></script>
Scripts that change often (analytics, chat widgets) can’t be pinned: keep their number small.

Your server announces its exact software version

What it is. Response headers reveal which server software and version you run.

Why it matters. It tells attackers exactly which known weaknesses to try.

Time to fix. About 5 minutes

Nginx

# in the http { } block
server_tokens off;

Apache / cPanel

ServerTokens Prod
ServerSignature Off

Any host

Hide the "Server" and "X-Powered-By" version numbers in your server or framework settings.

Your pages reveal which CMS version you run

What it is. A "generator" tag in your page source names your CMS and its version.

Why it matters. Attackers scan for exactly this to find sites running versions with known holes.

Time to fix. About 10 minutes

Any host

WordPress: add to your theme’s functions.php:
remove_action('wp_head', 'wp_generator');
Most security plugins also have a "hide version" switch.