Series note: part of an occasional series on outside-in security basics.

Most security advice starts after someone is already inside: patch this, sanitize that, review this code. But there is a whole layer of information your site gives away to anyone who asks politely, before a single login attempt or payload. A passive check only looks at what your server volunteers to the public internet. No credentials, no intrusive probing, nothing that would trip an alarm. It is basically reconnaissance, except you are doing it to yourself, which is the one time reconnaissance is unambiguously a good idea. Here is what that view actually shows you, and just as important, what it cannot.

The headers are talking

Every HTTP response carries headers, and plenty of stacks announce themselves in them. Server banners, X-Powered-By, framework cookies, build identifiers in asset URLs. On its own, a version string is not a vulnerability.…