Default server welcome pages: Crawl Audit check 170

Short answer: a freshly installed web server shows a placeholder page, such as "Welcome to nginx!" or Apache's "It works!". If visitors see one at your address, your site isn't set up properly, and the page tells attackers exactly what software you run. Check 170 fails if your homepage shows one.

What Crawl Audit checks

• Fail: the page contains a known default text: "Welcome to nginx", the Apache2 Default Page, "It works!", an IIS welcome page, or the Apache test page.
• Pass: none of them.

It matches text, so a real page that happens to say "It works!" will fail too. If yours does, the warning is safe to ignore.

What the sources say

• The nginx default page says: "If you see this page, nginx is successfully installed and working."
• OWASP: "In a default installation, many web servers, application servers, and frameworks provide sample applications, scaffolding, and test pages for the benefit of the developer". Its testing guide checks that "defaults and known files have been removed."
• OWASP: "While exposed server information is not necessarily in itself a vulnerability, it is information that can assist attackers in exploiting other vulnerabilities that may exist."

Common causes

• The domain points at the server, but the site was never configured for that name, so the server falls back to its default.
• Visiting by the server's IP address, or by www when only the bare domain is set up (check 165).
• A new server went live before the site was deployed.

Fix the site configuration so every name you use serves your site, then replace or delete the default page.

On devmarde.com

Our homepage contained none of these texts on 6 October. It passes.

Sources

• nginx, default index.html.
• OWASP Web Security Testing Guide, Application platform configuration and Fingerprint web server, checked 6 October 2026.