What is checked
- status.php: version, install state, maintenance mode and whether a database upgrade is pending.
- Patch level: compared with the current release of the branch and with the newest branch (data from endoflife.date, updated daily).
- Paths that must not be reachable from outside:
config/config.php,data/,.htaccessand.git/config. - richdocumentscode: the app behind the 2026 command-injection flaw — installed or not.
- Security headers of the login page: HSTS, nosniff, framing protection, Referrer-Policy and whether the PHP version is disclosed.
No login, no data
Nextcloud serves status.php publicly on purpose; it contains neither users nor files. This check does not log in, reads no content and stores nothing; to prevent abuse a salted hash of your IP address is kept for one hour. Only public HTTPS addresses are queried. For someone else's instance, ask the operator first — scanning without permission is rude and can be treated as an attack.
If something is red
config.php and data/ must answer 403 or 404. In nginx, inside the server block:
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { deny all; }
location ~ ^/\.(?!well-known) { deny all; }In Apache, in the vhost or .htaccess: <FilesMatch "^\.(?!well-known)"> Require all denied </FilesMatch> and <Files "config.php"> Require all denied </Files>. A .git directory does not belong in the webroot: delete it, don't just block it. X-Powered-By goes away with expose_php = Off in php.ini.
Version and support
Which Nextcloud branches still get security updates is listed daily under Nextcloud: versions and end of life. A branch without updates is the biggest risk — even when the installation is otherwise clean.
Privacy
The domain or address you enter is sent to this server, which runs the check. Nothing is stored; to prevent abuse a salted hash of your IP address is kept for one hour. Only public addresses are queried.