Support Library
End-of-Life Server Operating Systems
A response header of Microsoft-IIS/8.5 suggests Windows Server 2012 R2, and an Apache build marked (CentOS) suggests a CentOS-family system. Headers are self-reported and don’t show the release or patch level, so confirm on the server. When that operating system has stopped getting security updates, every flaw found in it afterwards stays open on a machine that faces the internet.
The short answer
Move the website to a server running a supported operating system, such as Windows Server 2022 or 2025, or a current Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, Debian or Ubuntu LTS release. Then check the rest of the network for machines of the same age.
How the headers give it away
How DNS Panopticon detects it
Security Posture reads the Server and X-Powered-By headers from your homepage and maps them to an operating system only where the version points to one. A header can be rewritten, IIS versions also ship with client editions of Windows, and a (CentOS) token does not show the release or tell CentOS Linux from CentOS Stream, so treat a match as a strong hint to confirm on the server, not a diagnosis. The result appears on the Endpoint Security card.
| Header shows | Usually indicates | Standard security support ended |
|---|---|---|
| Microsoft-IIS/6.0 | Windows Server 2003 | July 14, 2015 |
| Microsoft-IIS/7.0 | Windows Server 2008 | January 14, 2020 |
| Microsoft-IIS/7.5 | Windows Server 2008 R2 | January 14, 2020 |
| Microsoft-IIS/8.0 | Windows Server 2012 | October 10, 2023 (paid Extended Security Updates to October 13, 2026) |
| Microsoft-IIS/8.5 | Windows Server 2012 R2 | October 10, 2023 (paid Extended Security Updates to October 13, 2026) |
| Apache/… (CentOS) | CentOS Linux (the token does not rule out CentOS Stream) | June 30, 2024 (CentOS Linux 7, the last release) |
| Finding | Severity | When it appears |
|---|---|---|
| Website server headers point to … | High | One of the rows above matched. The finding shows the header it came from. |
| Operating system support couldn’t be determined | Unknown | The headers don’t point to an operating system that can be dated. Hiding it isn’t evidence of supported software, so the card isn’t graded. |
This is the only operating system evidence visible from outside, so the card says nothing about employee laptops or internal servers. End-of-life web software, such as an old PHP line, is graded separately on the Vulnerability Management card.
How to check it yourself
| Command | What it tells you |
|---|---|
| curl -sI https://example.com | The Server header the finding is based on. Run it anywhere. |
| Get-ComputerInfo -Property WindowsProductName, OsVersion | The exact Windows Server edition and build. Run it in PowerShell on the server. |
| cat /etc/os-release | The distribution name and release. Run it in a shell on the Linux server. |
Compare the result with the vendor’s lifecycle page: Microsoft Lifecycle, Red Hat Enterprise Linux life cycle, Ubuntu release cycle or Debian LTS.
Why it matters
- The whole machine is at risk. Operating system flaws, such as those in remote desktop, file sharing or the network stack, can let an attacker take over the server, not just the website.
- Patches stop for good. After the end-of-support date Microsoft and the Linux distributions no longer publish fixes, apart from paid extended programs.
- It signals wider ageing. An organisation with one internet-facing Windows Server 2012 machine often has others inside, along with old domain controllers and file servers.
- Insurers and auditors ask. Cyber insurance questionnaires and frameworks such as PCI DSS and Cyber Essentials expect supported, patched operating systems.
How to fix it
- Build a replacement server on a supported release rather than upgrading in place where you can. It is cleaner and gives you a fallback.
- Windows: move IIS sites to Windows Server 2022 or 2025 (IIS 10). Microsoft’s Web Deploy tool can migrate sites, settings and content. Check that application pools, .NET versions and certificates come across.
- CentOS Linux: move to AlmaLinux, Rocky Linux, Red Hat Enterprise Linux or CentOS Stream. Tools such as AlmaLinux ELevate and Red Hat’s Convert2RHEL can convert or upgrade some systems in place, but test them on a copy first.
- Switch traffic by updating DNS or the load balancer, keep the old server offline but available for a short rollback period, then retire it.
- If migration takes time, paid extended support (Microsoft Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13, 2026; vendors offer CentOS 7 extended support) can buy months, not years. Limit the server to the ports it needs.
- Look inside too. Inventory internal servers and desktops for the same unsupported versions.
FAQ
Our site shows Microsoft-IIS/10.0. Does that prove the OS is supported?
No. IIS 10 runs on Windows Server 2016, 2019, 2022 and 2025, as well as Windows 10 and 11, so it does not identify the release. Windows Server 2016 is in extended support until January 2027, so check which one you run.
We pay for Extended Security Updates. Why is it still flagged?
DNS Panopticon cannot see whether a server has an extended support contract, only which operating system it runs. If ESU covers the server, it is receiving security fixes for now, but the program has a fixed end date, so keep the migration on the calendar.
Should we just hide the Server header?
Hiding it removes the finding, but not the risk, and old Windows and Linux servers are easy to fingerprint in other ways. Migrating is the fix.
Sources and further reading
- Microsoft Lifecycle: Windows Server 2012 R2
- Microsoft Lifecycle: Windows Server 2008 R2
- Microsoft Learn: Extended Security Updates for Windows Server
- CentOS Project: CentOS Linux end of life
- Microsoft Learn: Introduction to Web Deploy: for migrating IIS sites
- AlmaLinux: ELevate: in-place upgrades from CentOS 7
- Red Hat: Converting to RHEL with the Convert2RHEL utility
- NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning