CMS versions
A content management system such as WordPress powers your website, and it is also the part attackers go after first. Once a version stops getting security updates, its known weaknesses stay open forever. The 'CMS Versions' page lists every CMS Cyberfusion found on your clusters and marks the ones running a version that no longer gets those updates.
Wondering where the list comes from and what the symbols in it mean? This article explains how CMSes are detected, how the security status is determined, and what to do about a site that is marked insecure.
Where to find the list
In the menu, open 'WebOps' > 'CMS Versions'.
The list follows the cluster you have selected, so switching clusters changes which sites you see.
How CMSes end up in the list
You don't register your CMSes anywhere. Cyberfusion looks at the document root of every virtual host on the cluster and recognises the files a WordPress install leaves there. Anything it finds is added automatically, and anything that disappears is removed again.
This means the list is a picture of what is actually installed, including sites someone set up outside Core and sites that were migrated in.
Reading the list
Each row shows:
- 'Domain': the domain of the virtual host the CMS runs on. Click it to open the virtual host.
- 'CMS': which software it is, shown as its logo.
- 'Version': the version currently installed, or 'Unknown'.
- 'Secure': whether that version still gets security updates.
Sites running an insecure version are listed first, then the ones whose status could not be determined, then the secure ones. Within each of those groups, the list is alphabetical by domain. The rows that need your attention are therefore always at the top.
What the security status means
| Symbol | Meaning |
|---|---|
| Green tick | This WordPress version still gets security updates. |
| Red cross | This WordPress version is no longer supported and gets no more security updates. Update the site. |
| Dash | Either the version could not be determined, or the software is not WordPress. Hover the question mark for which of the two it is. |
Cyberfusion only tracks security updates for WordPress. Other software, such as Nextcloud, is listed with its version but always shows a dash under 'Secure'.
Where the data comes from
Two things come together on this page.
The installed version is read from each WordPress site itself, on the cluster, as part of the regular health check run. So the versions refresh every 24 hours, and immediately when you click 'Refresh' on the health checks page of the cluster.
Whether a version still gets security updates comes from wordpress.org, which publishes the status of every WordPress release. Cyberfusion imports that list, so a release that is marked insecure there shows up as insecure here without anyone having to act.
A version shows as unknown when reading it from the site failed, for example because of a problem with the CMS itself, or when the installed version is not in the imported list.
What to do about an insecure version
Update the site to a version that still gets security updates. That is done in the CMS itself, not in Core.
You do not have to keep opening this page to notice. The same information drives the 'CMS version up to date' health check, which raises a warning per site and notifies you when a site that was fine becomes insecure. See All about health checks.