How to Read a Website Security Scan

You ran a scan and got a page full of grades, colours and findings. Now what? A security scan is only useful if you can tell the serious problems from the cosmetic ones and act in the right order. This guide walks through a typical result and how to turn it into a short, sensible to-do list.

What a scan actually checks

A typical external scan looks at things visible from outside your site: whether HTTPS is configured correctly, the strength of your TLS setup, which security headers you send, certificate validity and expiry, and sometimes response times and server details. It cannot see inside your application code or database, so it is one lens on your security, not the whole view.

Understand the severity levels

Findings are usually ranked by severity. The label matters less than the underlying question: what could an attacker do with this?

Prioritize by impact, not by count

A long list of low-severity notes can look scarier than a single high-severity finding, but the maths is the other way round. Sort by impact and likelihood. An expired certificate or a broken HTTPS redirect affects every visitor right now — fix that before you fine-tune a Referrer-Policy value. Work the critical and high items first, then medium, then low.

A worked example

Say a scan returns: (1) TLS 1.0 still enabled, (2) missing Content-Security-Policy, (3) missing Permissions-Policy, (4) certificate expiring in 40 days. A sensible order is:

1. Certificate expiry — schedule or automate renewal so nothing breaks; see certificate monitoring.
2. Disable old TLS — drop TLS 1.0/1.1 in favour of modern TLS.
3. Add CSP — a real defence against cross-site scripting, rolled out carefully.
4. Add Permissions-Policy — useful hardening, lower urgency.

Notice that the two items with immediate, site-wide impact come first, even though they weren’t at the top of the raw list.

Re-scan after every change

Security work is iterative. After you fix something, run the scan again to confirm the change actually took effect — misconfigurations often look fixed but aren’t. Re-scanning also catches regressions when a deployment or plugin update quietly undoes your work.

Where scans fit in

Use scanning as a repeatable checkpoint alongside the fundamentals in website security basics. It tells you where you stand from the outside; good habits keep you there. For exactly how our checks work and what they do and don’t cover, read the methodology.

Frequently asked questions

Related guides