It usually arrives as a forwarded email: someone ran a free scan on your website and the result is a wall of red. CRITICAL, HIGH RISK, IMMEDIATE ACTION REQUIRED. Before you panic, or pay the sender to make the red go away, read it like this.

First question: who profits from your fear?

Many free scanners exist to sell a service, and their business model rewards alarm. The same missing header can be reported as "informational" or as "CRITICAL: site vulnerable to attack" depending on who is doing the selling. Red does not mean urgent. It means someone chose the color.

Three tests for any finding

  • Does it cite a standard? A legitimate finding points at a public guideline: an OWASP recommendation, Mozilla web security documentation, a CVE number. If a finding cannot tell you where the rule comes from, it is an opinion wearing a costume.
  • Is it actually reachable? "Your site could be vulnerable to X" is very different from "we fetched this URL and here is what it returned". Concrete evidence you can reproduce beats hypotheticals.
  • Does the severity match the story? A publicly downloadable backup of your config file genuinely is critical. A missing Referrer-Policy is worth fixing and nowhere near an emergency. If everything is critical, nothing is.

The order that actually matters

  1. Exposed secrets and files first. Reachable .env files, config backups, open .git folders. These are real doors, not signals.
  2. Software updates second. Known vulnerabilities in outdated core, plugins or PHP are the most exploited path on the web.
  3. Headers and hardening third. HSTS, frame protection, cookie flags, disclosure trimming. Cheap, quick, real, and rarely urgent on their own.

What we do differently

AuditMerlin was built after watching clients receive exactly these scare reports. Our scan runs the same public checks, but every finding names the standard it comes from, says plainly how urgent it is, and the report card says out loud what it is not: a compliance certificate. Run one free and compare it to whatever landed in your inbox.