What an external website scan can and cannot see

What an outside check can see

Everything your site shows to every visitor is fair game, and that is more than most owners expect:

• Instructions to browsers. The security headers your server sends with every page, and how your cookies are protected.
• The secure connection. Whether https:// works, whether the certificate is valid and for the right name, when it expires, and whether the server still accepts outdated encryption.
• Your domain's public records. The DNS records that protect your email from forgery, such as SPF and DMARC, and web addresses that point to services you no longer use.
• The software you run, often with its version. Page code, file names and headers frequently name the content management system, plugins and script libraries, sometimes down to the exact version.
• Files that should never be public. Configuration files, database dumps and backups that were left in the web folder can be requested like any page.
• What happens when something goes wrong. Error pages that print code, file paths or debug information to anyone.

None of this needs an attack. It is all handed out freely, which is exactly why attackers' automated tools look at it first.

What an outside check cannot see

• Anything behind a login. The admin panel, customer accounts and checkout steps after sign-in are invisible without credentials.
• Your code and plugins from the inside. A flaw in how a contact form handles input only shows when someone actively tests it, which a passive check does not do.
• Passwords and accounts. Whether your admin password is strong, whether two-factor login is on, and who has access.
• Your server's internals. Installed updates, file permissions, backups, firewall rules and logs.
• Whether a fix was applied quietly. Many hosting companies patch software without changing its version number. From the outside an old-looking version can still be patched.
• Hidden versions. If your site does not show a version number (good practice), an outside check cannot compare it with known flaws at all.
• Whether you have already been hacked. A clean report is not a sign that no one got in earlier.

Why some results say "potential" or "unknown"

Because of those blind spots, an honest outside check has three answers, not two:

• Confirmed: seen directly. A missing header, a file we could download, an expired certificate.
• Potential: the signs point to a problem that cannot be proven from the outside, most often a version number below a fixed release.
• Unknown: there was not enough to go on: the version was hidden, a firewall blocked the request, or the check ran out of time.

Be wary of any scan that only ever says "vulnerable" or "safe". Where it cannot know, it is guessing.

Passive scan, active scan, penetration test

A passive check is the right first step for most small sites: it finds the common, cheap-to-fix problems that automated attack tools look for. If your site handles payments, health data or customer accounts, plan an active test or a penetration test as well.

How Scanylo stays passive

These rules are enforced in the code, not just promised here:

• Only GET and HEAD requests, the kinds a browser makes to read a page.
• A short, fixed list of well-known file addresses, under 30, one request each. No guessing addresses from word lists.
• At most 4 requests at a time to your site and about 150 in total, with a two-minute limit for the whole check.
• Every request carries our name and a link to our scanner page.
• Other addresses under your domain (such as www.) are only checked when your own site names them, in its certificate or on its pages, up to six of them.
• Sites that opt out are never checked, and government, military and banking sites are refused.

The full list of checks, and how the score is calculated from what they find, is on the methodology page.