✉ Emails we wrote for you

What to ask your web developer and hosting company about your website's security

Most website owners are not technical, and most security advice assumes they are. You do not need to understand headers or certificates. You need to know who to ask, what to ask, and what a good answer sounds like. This page gives you that, and the free check at the bottom writes the emails for your own site.

Who fixes what

Three different people can be responsible for your website, and sending a request to the wrong one wastes a week. Sometimes one company does all three jobs; then every email goes to them.

Your web developer or agency

Built the site, or keeps it updated. Owns the code, the theme, the plugins and the files on the site.

Theirs to fix

Security headers, cookies, exposed files such as backups, error pages that show too much, outdated plugins.

Your hosting company

Runs the server your site lives on. If you log in to a hosting panel to see your site, that is them.

Theirs to fix

The https certificate, old TLS versions, the PHP or platform version, server headers, redirecting http to https.

Your domain or email provider

Where your domain name is registered, or where your email is set up. Often the same company as the host.

Theirs to fix

SPF and DMARC records that stop fake emails in your name, subdomains that still point to old services.

Ten questions worth asking, and what a good answer sounds like

Ask for answers in writing. A good answer is specific. A worrying answer is "it's fine" or "I think so".

  1. Question 1 Host

    Which version of PHP, or of our platform, does our site run, and is it still supported with security fixes?

    A good answer: A specific version number, the date it was last updated, and a yes to supported. Many hosts hide the version from the outside, so this is the only way to know.

  2. Question 2 Host

    Is our https certificate renewed automatically, and who gets the warning if renewal fails?

    A good answer: Yes, automatic, with a named inbox that someone reads. Expired certificates make browsers show a full-page warning and visitors leave.

  3. Question 3 Host

    Does our server still accept the old TLS 1.0 and 1.1 connections?

    A good answer: No. Only TLS 1.2 and 1.3. The old versions are weak and no modern browser needs them.

  4. Question 4 Developer

    Does our site send the standard security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy?

    A good answer: A list of which ones are on, and a plan for the missing ones. Content-Security-Policy is the hardest; the others are usually one line each.

  5. Question 5 Developer

    Are our login and session cookies marked Secure, HttpOnly and SameSite?

    A good answer: Yes to all three. These flags stop cookies being stolen over an insecure connection or by a script that slipped onto a page.

  6. Question 6 Developer

    Could files like .env, .git, backups or database dumps be downloaded from our live site?

    A good answer: No, and here is how we block them. If the answer is "I think not", ask them to check today. These files hold passwords.

  7. Question 7 Developer

    What does a visitor see when something on the site breaks?

    A good answer: A plain error page. Never a page full of file paths and code, and never a debug screen. Those tell attackers how the site is built.

  8. Question 8 Developer

    Which plugins, themes and libraries are on the site, and when were they last updated?

    A good answer: A list with dates, and anything unused removed. Most hacked small sites are hacked through an outdated plugin.

  9. Question 9 Domain or email provider

    Do we have SPF and DMARC set up for our domain, and is DMARC enforcing?

    A good answer: Yes, with DMARC at quarantine or reject and reports going to an address someone reads. Without this, anyone can send email that looks like it came from you.

  10. Question 10 Domain or email provider

    Do any of our subdomains still point to services we no longer use?

    A good answer: A reviewed list, with old records removed. A forgotten subdomain pointing at a closed service can be claimed by someone else and used in your name.

How the free check does this for you

Paste your address below. In about two minutes Scanylo looks at your site from the outside, the way a visitor would, and gives you a report. At the end of the report are the emails: one per person, each listing only their items, with what to ask for, what we saw and how you will know it is done. Open them in your email app or copy them. Nothing to install, no account, and every result is marked Confirmed, Potential or Unknown, so nobody is asked to fix a guess.

Get the emails for your own site

Email me the report link (optional)

We send one confirmation first. You can also choose to get an alert when a big vulnerability might affect you.

Just the address of your site. We check the home page and a few well-known public files.

Questions people ask

What if the same company does everything?

Then send them the single combined email the report offers. It contains every item in one list.

Will my developer mind being sent this?

Good developers like a clear list. Each item carries the technical note they need and a link to the evidence, so there is nothing to argue about and nothing to guess. Items marked Potential or Unknown say so, and ask for confirmation rather than a fix.

Do I have to pay for the emails?

No. The check, the report and the emails are free. If your developer wants exact step-by-step settings for your setup, that is the optional fix plan.

This page is general guidance for website owners, not a security audit or legal advice. The check is passive and external: it never attacks or logs in. How it works.