CMS versions
A content management system such as WordPress powers your website, and it is also the part attackers go after first. Once a version stops getting security updates, its known weaknesses stay open forever. The 'CMS Versions' page lists every CMS Cyberfusion found across your sites and marks the ones running a version that no longer gets those updates.
Wondering where the list comes from and what the symbols in it mean? This article explains how CMSes are detected, how the security status is determined, and what to do about a site that is marked insecure.
Where to find the list
In the menu, open 'WebOps' > 'CMS Versions'.
Sites running a version that no longer gets security updates are listed first, so the ones to update are always at the top.
Reading the list
The list follows the cluster you have selected, so switching clusters changes which sites you see.
Each row shows:
- 'Domain' — the domain of the virtual host the CMS runs on. Click it to open the virtual host.
- 'CMS' — which software it is, shown as its logo.
- 'Version' — the version currently installed, or 'Unknown'.
- 'Secure' — whether that version still gets security updates.
Order: insecure sites first, then the ones whose status could not be determined, then the secure ones. Alphabetical by domain within each group. The rows that need your attention are always at the top.
What the security status means
| Symbol | Meaning |
|---|---|
| Green tick | This WordPress version still gets security updates. |
| Red cross | This WordPress version gets no more security updates. Update the site. |
| Dash | Either the version could not be determined, or the software is not WordPress. Hover the question mark to see which. |
Cyberfusion only tracks security updates for WordPress. Other software, such as Nextcloud, is listed with its version but always shows a dash under 'Secure'.
What to do about an insecure version
Update the site to a version that still gets security updates. You do that in the CMS itself, not in Core.
Why it matters: a content management system is the part attackers go after first. Once a version stops getting security updates, its known weaknesses stay open forever.
How CMSes end up in the list
You don't register them anywhere. Cyberfusion looks at the document root of every site on the cluster and recognises the files a WordPress install leaves there. Anything it finds is added; anything that disappears is removed.
So the list shows what is actually installed, including sites someone set up outside Core and sites that were migrated in.
Where the data comes from
- The installed version is read from each WordPress site on the cluster, as part of the regular health check run. It refreshes every 24 hours, and immediately when you click 'Refresh' on the cluster's health checks page.
- Whether that version still gets security updates comes from wordpress.org, which publishes the status of every WordPress release. Cyberfusion imports that list, so a release marked insecure there shows as insecure here without anyone having to act.
A version shows as unknown when reading it from the site failed — for example because of a problem with the CMS itself — or when the installed version is not in the imported list.
You don't have to keep checking this page
The same information drives the 'CMS version up to date' health check, which raises a warning per site and notifies you when a site that was fine becomes insecure. See All about health checks.