Software Watch: know when a site's software needs an update

Software Watch keeps a list of the software a website or server you host elsewhere runs, and says when a version needs an update: when a vulnerability is published for it, or when its makers stop fixing it.

A site belongs to Personal or a team. Everyone who can use Software Watch there sees its sites; a team admin decides who can.

The Free plan watches 1 site. Pro watches 10 sites, and a team on the Team plan watches 25.

Add a site

Choose Add site and enter a website's address, such as example.com, or a name for a server with no website. The site opens straight away.

A website is read from outside only once you show that you control it. The site's page offers three ways; add one of them:

• a DNS record: a TXT record with the name and value the page shows;
• a meta tag in the head of the home page;
• a file at the address the page shows, holding only the value.

The page checks every minute for 30 minutes and shows Verified when it finds one. Choose Check now to look again later. Keep the record, tag or file in place: Magpie checks it again before each daily scan, and pauses the scans if it is missing for 7 days.

If the team already verified a domain in Magpie, for Mail or a custom domain, Add site offers it, and a site on that domain, or on a name under it such as shop.example.com, is verified at once with nothing to add. It stays verified while the domain does.

A server with no website is never read from outside. Its software comes from the The Software Watch server check or from what you add yourself.

What Magpie finds

Once a day, a verified site is scanned the way a visitor's browser reads it: its home page, its response headers, its scripts and a few well-known addresses. Scan now scans it again within a minute, at most once every 10 minutes. The scan reads only what the site shows anyone; it never signs in and never sends a form.

The The Software Watch server check lists everything installed on a server, with exact versions, which a scan from outside cannot see.

You can also add software yourself: choose Add software on the site's Software list, or paste a lockfile or a list under Add from a file (Add a site's software by pasting a lockfile or a list). The drawer stays open after each one, so you can add the next straight away; each appears in the list behind it, and its name in the message opens it.

What Magpie checks

Each piece of software says what Magpie checks about it, and why:

• Checked: its exact version is compared with published vulnerabilities, from OSV, the National Vulnerability Database and CISA's list of actively exploited vulnerabilities, and with its release's end of life. WordPress plug-ins and themes are checked against Wordfence Intelligence's list; while Magpie is unable to reach it, they are marked Not checked and their pages say so.
• Checked in part: only part of the version is visible (8.1 rather than 8.1.27), or the version was read from outside on software that Linux distributions patch without changing its number. The server check tells for sure.
• Not checked: no vulnerability list is known for it. It stays on the list, and is checked once one is.
• Listed only: services and certificates, which are listed but have no versions to check. A certificate that expires within 14 days needs attention.

What needs attention

A site's page lists what Needs attention, by piece of software, urgent first: a vulnerability that is actively exploited, or critical with a fixed version, is urgent. May need attention lists vulnerabilities that apply to a version read from outside, which your Linux distribution may already have fixed.

Open a piece of software to see each finding: its severity, the version with the fix when one is published, and a link to the notice. When a finding does not apply to you, choose Mark not affected and say why. Your reason is kept with it, and Reopen finding opens it again. A new version is checked again.

After you update something, choose Mark as updated… on its finding and enter the version installed now, or run the server check again. When the version a scan or the server check found is wrong, enter the Corrected version: it is checked in place of the found one until a scan or a pasted list finds a different version. Software that is no longer there can be marked with Mark as not used on this site in More.

A finding is closed by itself when the version changes to one with the fix, and listed under Fixed in the last 30 days.

Email

Team admins get an email the morning something new needs attention, and within the hour for an urgent finding. See Software Watch email.

Pause or remove a site

Pause scanning in More stops the daily scan and the checks; Resume scanning starts them again. Move site to Trash removes it from the list with its software and findings; restore it from Trash within 30 days.

If a site cannot be verified or scanned for a reason you can't work out, Contactar con soporte.