What it does
When someone enters a domain, our checker makes one ordinary GET request to that site's homepage, the same request a web browser makes. It reads the response headers and the first part of the page to see what software the server says it runs, and compares any version it finds to the published fix.
What it never does
It does not send attack payloads, guess passwords, crawl other pages, submit forms, or try to change anything. It cannot see software the server does not publicly report.
Seeing us in your logs?
Requests come from Cloudflare's network with the user agent CTRL-A-WebExposureCheck/1.0. Someone entered your domain on this page. If you'd like your domain excluded, email support@ctrl-a.io and we'll add it to our block list.
Hide your version
For PHP, set expose_php = Off in php.ini and restart PHP. Then the X-Powered-By header no longer shows your version to anyone, including us.