3

The Alexa-rank auditing tool is complaining about a generator meta-tag that is according to the HTML5 standard:

<meta name="generator" content="Company Name"> 

The Alexa Site Audit Report complains about this tag being insecure:

What is this topic about?
HTML tags . on your pages that expose information about the software used to build your site.

Why is this important?
Insecure meta tags on your website provide information about the underlying software (such as Wordpress) that could help someone attack or compromise your website.

I've read comments from here and here, but it does not state why it may be insecure to use the generator meta-tag (it does say that it might be useless, but not insecure).

3

The tag itself is not insecure. It's just a tag in an HTML file.

What it does, though, is provide direct/immediate information about your the software you are using and thus can be used by hackers to select which of their hacking system to use to penetrate your system.

Without that information they would have to run probes and it could take a long time. Also with advanced web firewalls, you could detect such probes and block the IP address (Some people say blocking IPs is not a good idea, my experience is that it works wonders.)

Note that a tag which only gives a name is rather safe (i.e. content="Wordpress"). If the tag includes the name, version, build date, etc. then it becomes really easy (i.e. content="Wordpress 1.2.3 May 13, 2019"). So in your example, it is perfectly safe. Especially if your generator is proprietary and you use it for one or two websites (opposed to Wordpress which is used for million of websites.)


What is a probe?

Whenever you access a website you can detect which CMS was used to generate it by looking at the HTML contents.

Examples:

  • Wordpress uses paths that include wp- as an introducer.
  • Drupal uses .../sites/<name>/files/...

Every single CMS is going to do the same sort of thing for all the websites that use them. However, detecting the version is harder. You have subtle differences which will tell you but it makes the hacker's life more interesting (to my point of view--but read harder).

So hiding the generator's tag makes no difference if you just have the name of the CMS in there.

  • You forgot to mention the tag use, in this case, is useless clutter and should be removed for that reason alone. – Rob May 13 at 21:30
  • @Rob, well, it's like a copyright notice. Nearly no one read those... but we still stick them at the bottom of our pages. But I agree that even less people are going to read the HTML and see the "generator" info. – Alexis Wilke May 13 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.