Automated website security scans provide a quick overview of web application security. They work by testing your site against a list of known vulnerabilities and configuration standards.
The goal is to catch potential weak points — places where attackers could gain unauthorized access or steal data — before they’re exploited. These scans cover multiple areas of your site, including SSL/TLS, server configuration, file permissions, and HTTP response headers.
File Exposure and Infrastructure
A key part of any security scan is checking whether sensitive files are publicly accessible. Environment files, which store things like database credentials and API keys, should never be reachable by the public — and in this configuration, they’re properly protected.
The scan also checks that error logs and backup files are hidden, since exposing these can give attackers insight into your system structure and codebase. Additionally, the scan checks the expiration date of your SSL certificate to prevent downtime and ensure all traffic between your server and visitors stays encrypted.
Information Leakage and Session Management
The scan also flags two issues worth addressing.
First, your server is exposing the PHP version in its HTTP response headers. This is a risk because attackers can use that version number to look up known vulnerabilities and target your site more precisely.
Second, your cookies are missing the Secure flag. This flag ensures cookies are only sent over HTTPS connections. Without it, session data could be intercepted if a visitor accesses your site over an unsecured connection, leaving your site open to session hijacking and man-in-the-middle attacks.
HTTP Security Headers
HTTP security headers are instructions that your web server sends to a visitor’s browser along with your webpage. Think of them as a set of rules you give the browser, telling it how to handle your site’s content and what it’s allowed to do. When an automated security scan checks your site, one of the things it looks for is whether these headers are present and correctly configured.
Common headers and what they do:
- Strict-Transport-Security (HSTS) tells the browser to always connect to your site using HTTPS, even if the visitor types “http://” in the address bar. This prevents anyone from intercepting traffic over an unsecured connection.
- Content-Security-Policy (CSP) tells the browser which sources of content — scripts, images, fonts — are allowed to load on your page. For example, you can tell the browser to only load JavaScript from your own domain, which prevents attackers from injecting malicious scripts.
- X-Frame-Options tells the browser whether your site can be embedded inside another site using an iframe. Setting this to “deny” prevents a common attack called clickjacking, where attackers trick users into clicking hidden buttons on your site embedded within theirs.
- X-Content-Type-Options tells the browser to strictly follow the declared file type and not try to guess it. Without this, a browser might misinterpret an uploaded text file as executable code.
When an automated scan runs, it sends a request to your website and reads the response your server sends back. It checks which security headers are present, which are missing, and whether any are misconfigured. It then flags missing or incorrectly set headers as issues to fix, and confirms properly configured ones as passing.
Is My Website Okay runs automated security scans on your site and can be configured to run daily, notifying you whenever an issue is found. Sign up for a free account today to get started!