Ran free vulnerability scanner sites on my shop — got dozens of flaws, which ones actually need fixing?

Free scanners only inspect things from the outside looking at HTTP response headers. For instance, if your server response exposes your PHP or web server version, it immediately flags it as a medium-risk vulnerability. That's not a vulnerability, it's just information disclosure. Unless there's an actual confirmed exploit on that exact version, it's not worth spending money on.

Last year I panicked over the same thing and paid an external dev 1,600 AED for a 35-warning report. Once the job was done, we realized 28 of those "fixes" were just three lines of security headers added to the server config. There was only one plugin vulnerability that carried real risk, and we could've patched that for free just by updating the plugin ourselves.

Open the report and type these into the search bar: 'Injection', 'XSS' 'Bypass' 'Arbitrary File'. Flag the rows that contain these words, you'll probably end up with only 3-4 items in total. Tell your specialist to only verify and patch these specific items. You can ignore the rest for now.

Free scanning sites usually just want to scare you so they can sell their paid deep scans or consulting packages. If you look at the bottom of the page, there are usually 'fix this professionally with one click' offers right next to the report. Don't buy into every single item marked in red.

Is your site built on an off-the-shelf CMS like WordPress, or is it completely custom-built? Also, when processing payments, do you store credit card details on your own server, or do you redirect users to the payment gateway's hosted checkout page? The risk assessment changes completely based on that.

Stay calm, don't panic if your site isn't actively under attack right now. Automated tools dock points for every missing header. There's almost no site on the web that is a hundred percent warning-free. Your priority should always be the customer database, admin encryption mechanisms, and form fields.

There are usually 'CVE' or 'CWE' codes next to the items in the report. Just search those exact codes online for anything you don't understand. If you read a few forum posts in Turkish or English explaining what the vulnerability actually does in practice you'll be in a much better position when talking to your developer.

Ill try it.

Correct. Everything goes well for the first three months; problems arise in the fourth.

If you don't write this down from the start, it leads to arguments later. If you have questions, write them; I'll answer as best I can.

If I understood correctly, you're saying: When making decisions, write down the worst-case scenario too, not just the best.

If you get three different answers on a topic, the question was asked wrong. If I were you, I'd go this route.

Let me summarize what's been said so far. Just because everyone does it doesn't mean it's right.

The biggest time-waster for us was not knowing who had the final say. If you have questions, write them; I'll answer as best I can.

we got stuck at the same point for a while. honestly the real issue isn't the number but what it's based on.

everyone rushing into vulnerability scanner site gets stuck at the same point. that's all sorry if I went on too long.

I agree. Forgotten test environments are more often the entry point than live systems.

That's all, sorry if I went on too long.

If I understood correctly, you're saying: Processes without records never improve, because you don't know what to fix.

Yes, that's exactly how it is with vulnerability scanner site. If you scold false alarms, nobody will report again.

Most incidents start with a leaked password, not a vulnerability.

I've been dealing with this for a long time. Having backups accessible on the same network and with the same identity makes them part of the target.

Hope this helps.

I didn't know that. When we decide without measuring, we always end up in the same place.

Hasty decisions become decisions you have to fix six months later. If you have questions, write them; I'll answer as best I can.

I have no experience with vulnerability scanner site, so I'm asking. The real issue isn't the number, but what it's based on.

If I were you, I'd go this route.