Website security basics: checks, scans and fixes

Website security basics are the checks every owner can run without a security team: spotting signs of a hack, reading a vulnerability record, scanning with permission, and asking for proof that a fix took effect. New advisories land every week, so it pays to know these steps before the next one names your software.

What matters right now

• A missing version is not a clean bill. The CVE record format says versions that match no listed range take the defaultStatus, which is unknown when omitted, per the CVE record schema.
• Absence from CISA's list does not mean nobody is attacking. The Known Exploited Vulnerabilities catalog only records confirmed exploitation. Re-check it for each CVE you care about.
• Misconfiguration ranks near the top. The OWASP Top 10:2025 lists Broken Access Control as A01 and Security Misconfiguration as A02.
• Permission comes before any test. Testing a site you do not have authority over can be an offence in the US, UK, EU and Sweden, and a security.txt file does not grant it, per RFC 9116 (checked 24 October 2026).
• Cleanup takes weeks to clear. Google says malware reviews take a few days and spam-related hacking reviews can take up to several weeks, in Search Console Help.

Where to start

• If you suspect something is wrong, read how to tell if your website is hacked before changing anything.
• If you have two hours and one site, work through the small business security checklist.
• If an advisory names your software, learn how to read a CVE and decide if you are affected.
• If you want to test your own site, see how to scan your website with permission and read the results.
• If you are unsure what counts as permission, the page on whether scanning a website is legal explains authorization.
• If a scan came back empty, see what an outside scan cannot prove and why no issues found is not proof of a patch.
• If you were told a fix is done, ask for the five proofs that a vulnerability is fixed.
• If you run PHP, the PHP security practices put patching and restarts first, and PHP2Shell explained shows a record read end to end.

The free scan on Red by run.cloud reads the stack your site serves and matches each version to known vulnerabilities, one per domain, no card. It can say a version is affected, not whether your setup is exposed.