Supply chain and setup Required

Keep software current and quiet

Install security updates for the system, server and runtime within 7 days for critical or exploited holes, and within 30 days for the rest. Don't tell visitors which versions you run.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Turn on automatic security updates, and check a supported-versions list each month. Treat holes on a known-exploited list, such as CISA KEV, as critical. Hide version numbers in headers and error pages, for example with server_tokens off in nginx. Hiding a version is no fix, so still update. See also install security updates by themselves.

Example

Server: nginx

How to check

curl -sI https://staging.example.com/ shows no version numbers. The package manager lists no security update older than 30 days. The runtime and server are on versions their makers still support.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/patch-and-hide-versions.