---
title: "Keep software current and quiet · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/patch-and-hide-versions
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep software current and quiet

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Install security updates for the system, server and runtime within 7 days for critical or exploited holes, and within 30 days for the rest. Don't tell visitors which versions you run.
- How: Turn on automatic security updates, and check a supported-versions list each month. Treat holes on a known-exploited list, such as CISA KEV, as critical. Hide version numbers in headers and error pages, for example with `server_tokens off` in nginx. Hiding a version is no fix, so still update. See also [install security updates by themselves](https://agentwranglers.se/playbook/infrastructure/servers/automatic-security-updates).
- Check: `curl -sI https://staging.example.com/` shows no version numbers. The package manager lists no security update older than 30 days. The runtime and server are on versions their makers still support.

Example:

```http
Server: nginx
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/patch-and-hide-versions`.

- Previous: [Remove defaults and samples](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/remove-defaults)
- Next: [Log attacks without personal data](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-logging)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)