CMS vulnerability monitoring for Drupal, Joomla, PrestaShop and Magento.
Relvato reads which CMS your site runs and how much of its version shows from outside, then matches it against known core vulnerabilities and end-of-life dates. Nothing to install on the site.
- ✓Which CMS runs the site: Drupal, Joomla, PrestaShop or Magento
- ✓How much of its version shows from outside: the exact release, only the major version, or none
- ✓Exact release: each known core vulnerability affecting it, with the release that fixes it
- ✓Only the major version (Drupal 8 and later show just “Drupal 10”, Magento shows “2.4”): the advisories from the last year on that line and the release to be on
- ✓End-of-life versions such as Drupal 7, Joomla 3 and 4 or Magento 1, always reported
- ✓A firewall block reported as “couldn't run”, never as a clean result
A CMS core with a published hole is one of the first things attackers scan for, and a version past its end of life gets no security fixes at all: Drupal 7, Joomla 3 and 4 and Magento 1 are all there. Without a plugin, nothing on the site tells you. Relvato looks from outside and says only what it can actually see: each advisory with its fix when the exact release shows, the release to be on when only the major version shows. Running WordPress? Use vulnerability monitoring instead: it reads your plugins, themes and WordPress itself from inside.
- Reads your homepage the way a visitor's browser does, for the signs each CMS leaves: its generator tag, its response headers, the paths of its scripts and styles.
- Asks for at most one public file that ships with the CMS, and only when it would show more of the version: Joomla's /administrator/manifests/files/joomla.xml, Drupal 7's /CHANGELOG.txt or Magento's /magento_version. Read-only requests, nothing else.
- Matches the version against known core vulnerabilities from OSV.dev, the NVD and the Joomla! Security Centre, and against end-of-life dates from endoflife.date. An exact release is matched advisory by advisory; when only the major version shows, you get the release to be on; when no version shows, the latest releases.
Data sourceOSV.dev (GitHub Advisory Database, CC BY 4.0, and the Drupal Security Team's database), NVD (National Vulnerability Database), Joomla! Security Centre, endoflife.date
Which sites does it work on?
Drupal, Joomla, PrestaShop and Magento (Adobe Commerce) sites, from outside, with nothing to install. On a site that isn't one of the four, it says it doesn't apply. WordPress sites have their own vulnerability monitor, which reads plugins, themes and WordPress itself from inside, so this one isn't offered there.
Does it cover my modules and extensions?
No. Drupal modules, Joomla extensions, PrestaShop modules and Magento extensions don't show their versions from outside, so this monitor covers the CMS core only. Keep your extensions updated from your CMS's admin.
Why does it say “make sure you're on” instead of “vulnerable”?
Because often only the major version is visible. Drupal 8 and later show just “Drupal 10” in the page, and Magento's /magento_version shows just “2.4”. From that, Relvato can't tell an old 10.x release from the newest one, so it never says the site is vulnerable. It gives one warning instead, for example: “3 advisories from the last year affect some 10.x releases — make sure you're on 10.6.20 or later”. When the exact release shows (Joomla's manifest file, Drupal 7's CHANGELOG.txt), each advisory affecting it is reported as a problem, with the release that fixes it. When no version shows at all, as on PrestaShop 1.7 and later, you get a reminder naming the latest releases, and no claim.
What about versions past their end of life?
They're always reported whenever the version or the version line shows, because they get no security fixes: Drupal 7, Joomla 3 and 4, Magento 1, with the version to upgrade to. End-of-life dates come from endoflife.date; Magento 1's (30 June 2020) is built in. PrestaShop isn't on endoflife.date, so Relvato makes no end-of-life claim about it.
What if my firewall blocks Relvato?
If the homepage answers with a block (HTTP 401, 403 or 429) or a bot-protection page, the run is reported as “couldn't run”, never as clean. If only the one CMS file is refused, Relvato goes by what the homepage showed. To let Relvato through, allow its requests in your firewall.
Where does the vulnerability data come from?
From OSV.dev (the GitHub Advisory Database and the Drupal Security Team's database), the NVD and the Joomla! Security Centre, merged where they describe the same advisory and refreshed every day. End-of-life dates come from endoflife.date. Each finding links to its advisory. This product uses the NVD API but is not endorsed or certified by the NVD.
Do I need to prove I own the site, and how often does it run?
Yes: it lists known holes in a site's software, so it runs only on a site whose ownership you've proven, with a DNS record or a meta tag. It's on every plan, Free included: on Free you run it yourself or weekly; from Pro it runs every day.
Put this monitor on autopilot.
Free forever on one site — 100 runs a month, started by you or weekly, no card. Pro re-runs your monitors by itself after every update.