Ran an online security audit on our site — serious vulnerabilities came up, should we believe them?

Scanners usually just read the Apache or Nginx version string from the server header and dump every known historic CVE for that release into your report. Meanwhile, your server might already have that vulnerability patched under the hood via OS package updates. If you hide the server version from public headers, half the warnings in those reports magically disappear.

Most free scanning sites are just marketing funnels. They flash red warning icons and terrifying risk scores, followed immediately by a big 'Clean up vulnerabilities with one click' button at the bottom. What you are seeing is not a genuine penetration test, it's just a scare tactic engineered to sell remediation services.

I've been managing e-commerce sites for years; whenever a panicked client brings me one of these reports, the vast majority of the flagged items don't pose any actual real-world risk. Automated tools can give you food for thought, but they cannot give you a proper roadmap. My advice: bump up your backup frequency and put two-factor authentication on your admin dashboard.

Don't go spending money just yet. First, move your admin panel URL away from the default path. Next, ensure a web application firewall (WAF) is active on the server level. Those two simple moves alone will render most automated external scans completely ineffective anyway.

A similar tool flagged five critical vulnerabilities on our own site. When I had our developer look into it, four turned out to be false alarms, and only one was an outdated contact form plugin. Removing that plugin and installing an alternative took half an hour and didn't cost us a single Ruble.

automated tools usually just scan the headers like a robot and move on. I mean they don't actually test forms one by one to see if they can steal data. imo run another check with a free open-source scanner before panicking and throwing money at it.

How does the checkout step work on your site? Do you collect card details directly on your own form, or do you redirect the customer to an external bank page? If you use an external gateway, there’s no risk of card leaks anyway, only the customer address list would be exposed.

note: I wrote this based on my own experience, it might not apply to everyone.

To sum it up: Don't rush into spending 45.000 Ruble just because of red warnings on a report. Most vulnerabilities are just version disclosures and missing security headers. Update your software, turn on two-factor authentication, and if needed, only get an expert opinion for specific plugins.

You're right. Everyone rushing into website security audit gets stuck at the same point.

If I were you, I'd go this route.

Let me summarize the topic since several different answers were given. Security isn't absolute; it's about making attacks not worth the effort.

If you get three different answers on a topic the question was asked wrong. Proven by experience.

i'd appreciate it if you shared the outcome.

Correct. If permission and scope aren't in writing, don't start that test.

This is my opinion, I'm not claiming it's absolute truth.

I felt relieved reading this answer, so it's not just me. Forgotten test environments are more often the entry point than live systems.

Forgotten test environments are more often the entry point than live systems. Of course, it varies if your situation is different.

Noted, thanks.

We got stuck at the same point for a while. If you scold false alarms nobody will report again.

Of course, it varies if your situation is different.

I went through the same thing. The harder it is to reverse a decision, the slower you should make it.

I have a question. When you try to change everything at once nothing settles.

Let's separate the concepts, they're getting mixed up. Payment information changes are never verified through the channel they came from.

When you try to change everything at once, nothing settles. Hope this helps.