Blog

Automated website security scans provide a quick overview of web application security. They work by testing your site against a list of known vulnerabilities and configuration standards.

The goal is to catch potential weak points — places where attackers could gain unauthorized access or steal data — before they’re exploited. These scans cover multiple areas of your site, including SSL/TLS, server configuration, file permissions, and HTTP response headers.

File Exposure and Infrastructure

A key part of any security scan is checking whether sensitive files are publicly accessible. Environment files, which store things like database credentials and API keys, should never be reachable by the public — and in this configuration, they’re properly protected.

The scan also checks that error logs and backup files are hidden, since exposing these can give attackers insight into your system structure and codebase. Additionally, the scan checks the expiration date of your SSL certificate to prevent downtime and ensure all traffic between your server and visitors stays encrypted.

Information Leakage and Session Management

The scan also flags two issues worth addressing.

First, your server is exposing the PHP version in its HTTP response headers. This is a risk because attackers can use that version number to look up known vulnerabilities and target your site more precisely.

Second, your cookies are missing the Secure flag. This flag ensures cookies are only sent over HTTPS connections. Without it, session data could be intercepted if a visitor accesses your site over an unsecured connection, leaving your site open to session hijacking and man-in-the-middle attacks.

HTTP Security Headers

HTTP security headers are instructions that your web server sends to a visitor’s browser along with your webpage. Think of them as a set of rules you give the browser, telling it how to handle your site’s content and what it’s allowed to do. When an automated security scan checks your site, one of the things it looks for is whether these headers are present and correctly configured.

Common headers and what they do:

• Strict-Transport-Security (HSTS) tells the browser to always connect to your site using HTTPS, even if the visitor types “http://” in the address bar. This prevents anyone from intercepting traffic over an unsecured connection.
• Content-Security-Policy (CSP) tells the browser which sources of content — scripts, images, fonts — are allowed to load on your page. For example, you can tell the browser to only load JavaScript from your own domain, which prevents attackers from injecting malicious scripts.
• X-Frame-Options tells the browser whether your site can be embedded inside another site using an iframe. Setting this to “deny” prevents a common attack called clickjacking, where attackers trick users into clicking hidden buttons on your site embedded within theirs.
• X-Content-Type-Options tells the browser to strictly follow the declared file type and not try to guess it. Without this, a browser might misinterpret an uploaded text file as executable code.

When an automated scan runs, it sends a request to your website and reads the response your server sends back. It checks which security headers are present, which are missing, and whether any are misconfigured. It then flags missing or incorrectly set headers as issues to fix, and confirms properly configured ones as passing.

Is My Website Okay runs automated security scans on your site and can be configured to run daily, notifying you whenever an issue is found. Sign up for a free account today to get started!

Blocklists, also known as spam blacklists and DNSBLs or RBLs, are databases used by email administrators to prevent unsolicited bulk email (spam) from reaching inboxes. These lists contain Internet Protocol (IP) addresses or domain names that have been identified as sources of spam, malware, or other malicious activity.

When an email server receives an incoming message, it can query a blocklist to determine if the sender is reputable. If the sender’s IP address or domain appears on the list, the email is typically rejected or flagged as spam.

History and Terminology

The concept of blocking email based on the sender’s reputation dates back to the early days of the commercial internet. The first notable implementation was the Real-time Blackhole List (RBL), created in 1997 by Paul Vixie. The term “RBL” is often used generically, though technically it refers to the specific system Vixie developed.

Today, the industry-standard term is DNSBL (Domain Name System Blocklist), reflecting the method used to query these databases. Administrators configure their mail transfer agents (MTAs) to check specific DNS zones that host these lists in real-time.

How Blocklists Work

The process of blocklisting relies on the Domain Name System (DNS). When a sending server attempts to deliver an email:

1. The receiving server identifies the IP address of the connecting machine.
2. The receiving server sends a DNS query to the blocklist provider (e.g., 4.3.2.1.zen.spamhaus.org).
3. If the IP is listed, the blocklist provider returns a specific code (usually 127.0.0.x).
4. The receiving server rejects the connection, often sending a bounce message to the sender with an explanation.

Types of Blocklists

Blocklists are generally categorized by what they list and how they gather data:

• IP-based Blocklists: The most common type, listing the IP addresses of servers known to send spam or infected by botnets.
• Domain-based Blocklists (URI Blocklists): These list domain names found within the body of the email. Even if the sending IP is clean, an email may be blocked if it contains a link to a known spam site.
• Public vs. Private: Public lists (such as Spamhaus or SpamCop) are available for general use, often free for low volumes. Private lists are maintained internally by large email providers (like Gmail or Outlook) based on their proprietary data.

False Positives and Delisting

A significant criticism of blocklists is the potential for false positives, where legitimate email is blocked because a shared IP address was abused by a different user, or a server was temporarily compromised.

Most reputable blocklist operators provide a delisting process. Administrators can submit a request to have their IP removed from the list after proving they have resolved the underlying security issue (such as securing an open relay or removing malware).

Is My Website Okay allows you to check whether your website has been added to these types of blacklists, so you can take action and ask for its removal before it affects your business. Sign up for a free account to try it out!

Ranking check typically correlates with Domain Authority (DA) and Spam Score.

Domain Authority (DA) and Spam Score are proprietary metrics developed by the SEO software company Moz. These metrics are widely utilized in the field of search engine optimization (SEO) to quantify the potential ranking strength and the quality of a website’s backlink profile.

While DA and Spam Score are not direct ranking factors used by search engines like Google, they serve as predictive indicators for how well a website may perform in search engine results pages (SERPs).

Domain Authority (DA)

Domain Authority is a search engine ranking score that ranges from 1 to 100, with higher scores corresponding to a greater ability to rank. It is calculated by evaluating multiple factors, including linking root domains and the total number of links, into a single score. This score can then be used when comparing websites or tracking the “ranking strength” of a website over time.

• Logarithmic Scale
  DA is calculated on a logarithmic scale. This means that it is significantly easier to grow a score from 20 to 30 than to grow a score from 70 to 80.
• Comparative Tool
  SEO professionals generally use DA as a comparative metric rather than an absolute one. For example, if a direct competitor has a DA of 50, a site with a DA of 55 is considered to have a stronger profile, regardless of the fact that it is far from the maximum score of 100.
• Calculation
  The metric uses a machine learning model to predictively find the “best fit” algorithm that correlates with rankings across thousands of actual search results.

Spam Score

Spam Score is a metric used to gauge the quality of a website’s inbound link profile and the likelihood of the site being penalized by search engines. It represents the percentage of sites with similar features to the site being analyzed that have been penalized or banned by Google.

The score is based on 27 common features correlated with penalized sites. These signals include factors such as:

• A low ratio of clicked links to valid links.
• A lack of contact information on the site.
• Heavy use of external links in navigation.
• Thin content or the use of specific top-level domains (TLDs) is often associated with spam.

Scoring Tiers:

• 1% – 30%: Considered a Low Spam Score.
• 31% – 60%: Considered a Medium Spam Score.
• 61% – 100%: Considered a High Spam Score.

A high Spam Score does not necessarily mean a site is spam, but rather that it shares many attributes with sites that have been penalized. The Spam Score check is often used by webmasters to audit their own backlinks and disavow toxic links that could harm their rankings.

Distinction from Google PageRank

It is crucial to note that neither Domain Authority nor Spam Score metrics are determined by Google. Google uses its own internal algorithms (such as PageRank) to order search results. However, because Google does not make its internal scores public, metrics like DA and Spam Score serve as industry-standard proxies for assessing website authority and health.

Is My Website Okay allows you to check your website’s Domain Authority and Spam Score metrics and also be notified if they change. Sign up for a free account today to get started!