Website security scan: what it checks and what it misses

You have heard that you should “scan your website”. Maybe your host sent an email, or an insurer asked, or a customer wanted proof that your site is safe. Then you search for it and find a dozen tools, each promising to find “vulnerabilities”, and no plain explanation of what they do.

Here is the plain version. A website security scan is a check of your site from the outside, the way a stranger would see it. It does not log in. It does not need your password. It looks at what your website shows to anyone who visits, and flags the things that make an attacker’s job easier.

What a scan is, and what it is not

Security people call this kind of tool a web application vulnerability scanner. OWASP, the non-profit that publishes widely used web security guidance, describes these tools as automated programmes that scan websites, normally from the outside, to look for weaknesses.

That “from the outside” matters. A scan is not a break-in, and it is not a full audit. Think of a surveyor walking around your building and noting the unlocked window, the missing lock on the back gate and the spare key under the mat. They have not gone through your filing cabinets.

What a good scan looks at

Different tools check different things, but a scan of a small business site usually covers the same few areas.

1. Whether visitors get a secure connection. Does the site work over https, and does someone who types the address without it get moved to the secure version? Mozilla’s web security guides list redirecting to https as one of the highest-impact, easiest things a site can do. Without it, what visitors type can be read by others on the same network.

2. The instructions your site sends to browsers. Every page arrives with hidden security instructions. One tells browsers to always use https for your site. Another, called a content security policy, is a list of the code your pages are allowed to run. Mozilla describes it as a defence against attackers who slip their own code onto a victim’s site. A scan reads these and tells you which are missing, too loose, or contradicting each other.

3. Whether other sites can trick your visitors. Can another website show your page invisibly inside its own and trick people into clicking? Are the small files that keep people logged in (cookies) protected? A scan checks both.

4. Things your site gives away. The version of PHP your server runs, or the version of WordPress your pages announce. Attackers use these details to choose which known weaknesses to try first. When PHP2Shell was made public in October 2026, the first question for owners was which PHP version they ran. We explain that in our PHP2Shell post.

5. Secrets left in public view. Sometimes a password or private key ends up in the code every visitor downloads. Attackers scan the web for these all day. This is the finding you want to hear about first, because it should be treated as already stolen.

6. Old software. An outdated WordPress release, or an old add-on library with weaknesses that were published years ago.

What our free scanner checks

We built a free website security checker that covers the areas above. It reads only what a visitor’s browser receives: your page, the security settings it sends, your site’s own script files and up to three published code maps. On WordPress sites it also reads a few public addresses that WordPress exposes, to see whether your usernames can be listed and whether an old side door is still open.

It only reads. It does not try passwords, does not hunt for hidden files, and does not change anything on your site. The result is a grade from A to F, with each problem explained in plain English and ranked by what to deal with first. There is no signup and you do not enter an email address.

What a scan cannot see

This part matters more than the checklist, because a clean result can give false comfort.

• Your logins. A scan cannot tell whether your staff reuse passwords, or whether your admin account has a weak one. See our post on how to tell if your website is hacked for signs that matter more than any grade.
• Inside your server. It cannot see your hosting account, your file permissions or who has access.
• How your plugins behave. It can spot an old version, not a flaw nobody has published yet.
• A break-in that has already happened. A site can score well and still carry hidden malware from last month.

So a clean scan means the things it looks for were fine. It does not mean you are safe. We say the same on the checker page, because we would rather be honest than sell you comfort.

How to read the result

Do not chase the grade. Read the findings in order and ask three questions of each one.

1. Is something exposed right now? A leaked key or a missing secure connection comes first.
2. Who is affected? Your visitors, your customers, or only you?
3. Who fixes it, and how long will it take? Some items are a quick job for your developer. Others touch how the whole site is built.

The UK National Cyber Security Centre gives the same advice for any organisation. When you first start, it is easy to be overwhelmed by the number of issues, so prioritise and start small. Update by default, and decide deliberately about anything you choose not to fix.

What to ask your host or developer

If a scan flags something, you do not need to learn the fix. You need to ask good questions.

• “Is my site served over https everywhere, and does the plain address move to it?”
• “Which version of PHP does my site run, and is it still supported?”
• “Is WordPress, and every plugin and theme, on its latest release?”
• “Does my site send the standard security instructions to browsers? Which ones?”
• “Is anything private, such as a key or a password, visible in my site’s public code?”

Ask for answers in writing. A host who cannot answer these has told you something useful.

How often to scan

Run one when your site is built or changed, after any news that affects your software, and every few months after that. A scan takes under a minute, so there is little reason to wait for a problem.

Want us to check yours?

Start with the free website security checker. It takes about a minute, and the result is written for a business owner, not an engineer.

If it shows problems you would rather not handle yourself, our website security service looks at your site from the outside, ranks what it finds, fixes it in a safe order without taking the site offline, and checks it again with you.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Vulnerability Scanning Tools, OWASP Foundation. Source for what a web vulnerability scanner is and that these tools scan from the outside.
• Practical security implementation guides, MDN Web Docs. Source for the https redirect, the always-use-https instruction and Mozilla’s Observatory grading.
• Content Security Policy (CSP), MDN Web Docs. Source for what a content security policy does against injected code.
• Vulnerability management guidance, National Cyber Security Centre (UK). Source for starting small, prioritising and updating by default.