Nikto Web Server Scan

What this check runs

This check runs a Nikto style web-server scan against your host. Nikto focuses on the server and deployment layer rather than application logic: it checks for dangerous default files, outdated server software, risky HTTP methods, server version disclosure and known problematic paths.

Where an application scanner tests your code's behaviour, this one tests the box your code runs on and how it is configured.

Why it matters

Web servers ship with defaults that are convenient and insecure: sample files, verbose version banners, methods like PUT or TRACE enabled, and directories that reveal more than intended. Each is a small disclosure, and together they let an attacker fingerprint your stack precisely and target known weaknesses in the exact versions you run.

Server version disclosure is the quiet enabler. When your server announces its exact version, an attacker no longer has to probe for which vulnerabilities apply; they look them up.

What the findings mean

Findings are grouped by what the scan surfaced: a disclosed version, an enabled dangerous method, an accessible default file. Most are information disclosure or configuration hardening rather than direct vulnerabilities, but they lower the effort of every subsequent attack.

The remedy is server hardening: suppress version banners, disable unused HTTP methods, remove default and sample files, and keep the server software current. Run a scan to see what your server is currently revealing.