What does an online website security scanner check, what can it not see, and how do you read the score?

An online website security scanner looks at your site the way anyone on the internet sees it. You type in the address, the scanner sends requests to the site, reads the answers and compares them with a list of known problems. It needs no password, no plugin and no access to your server.

That cuts both ways. The good part: you get an answer in minutes and you do not have to ask anyone for access. The limit: the scanner only sees what the site shows to the outside world. Below is what fits into that view, what does not, and how to read the report so you know what to do next.

What a scanner can see from the outside

A scanner starts where an attacker starts. The bots that comb the internet every day for easy targets do not have your passwords either. They read whatever can be read without logging in. A good online scanner looks at the same places:

• Certificate and encryption. Whether the SSL certificate is valid and when it expires, whether the server still accepts outdated encryption, and whether every variant of your address ends up on https://.
• Software versions. Your page source often gives away the version of WordPress, the theme, plugins and JavaScript libraries. The scanner checks them against databases of known vulnerabilities.
• Files in plain view. Backups named like backup.zip, .env files, a .git folder, logs and database dumps. If the server hands them to anyone who asks, the scanner will see them.
• Security headers and cookies. Whether the browser gets the instructions that make it harder to frame your site or inject a script, and whether session cookies carry the right flags.
• Email. The SPF, DKIM and DMARC records, which decide whether a stranger can send mail that looks like it came from your domain.
• Malicious code and reputation. Whether the domain is on threat lists such as Google Safe Browsing, and whether the home page code contains hidden frames or suspicious redirects.
• Open ports and forgotten subdomains. A database admin panel exposed to the internet, or an old test copy of the site at something like test.yourdomain.com.

ShieldWave runs 20+ checks of this kind in one pass, in about 90 seconds. The checks that send test data to your forms run only after you confirm the site is yours. Without that, ShieldWave only reads what the site shows every visitor.

What an online scanner cannot check

Anything behind a login or inside the files on your server is out of reach for a scan from the outside:

• PHP files. The scanner cannot open files on the server, so it will not find a backdoor that leaves no trace in the page. On WordPress, that is the job of a plugin working from the inside, or of the malware scanner in your hosting panel.
• Accounts and passwords. It cannot tell how many administrators you have, whether someone logs in with "admin123", or whether two-factor login is on.
• Plugins that leave no trace. If a plugin adds nothing to the page source, the scanner cannot learn its version.
• Database content. Spam added to old posts that appears on only a few pages.
• The logic of your shop or app. Whether a customer can see someone else's order by changing a number in the address. A person checks that in a penetration test: a specialist spends several days trying to break in by hand, knowing how your business works.

So a scan from the outside replaces neither a plugin nor a penetration test. It answers a different question: what does everyone who lands on your site see, bots included. Two of the most common topics on that list have their own articles: outdated plugins and security headers.

How to read a 0-100 score

ShieldWave sums up a scan in one number from 0 to 100. The higher it is, the fewer problems the checks found and the less serious they are. The number is good for two things: comparing your site with itself after fixes, and a quick answer to whether something needs doing this week.

Three rules:

1. Read the list as well as the number. A site scoring 70 with one critical problem needs faster action than a site scoring 60 with a dozen minor notes.
2. A high score does not mean the site is secure. It means the outside checks found little. The things from the previous section can still be wrong.
3. Compare dates. The same scan a month later shows whether the fixes worked and whether something new appeared, such as a plugin vulnerability published in the meantime.

The three most serious findings on the free plan

The free plan shows your score and your three most serious problems. The list is short on purpose: if something needs fixing this week, it will be on it.

Each finding says what is wrong and what it means for the business, without jargon. The top of the list usually holds things like a backup anyone can download, a plugin with a known vulnerability, or a certificate about to expire.

The full report sorts every finding into three time frames: this week, this month and later. It adds a brief for your developer with the technical detail they need to price the work. If you are not sure how to hand that over, read how to talk to your developer about security.

Where moje.cert.pl fits

If your business or organisation is in Poland, open an account at moje.cert.pl. It is a free service run by CERT Polska, the national incident response team that works within NASK. You can order a scan of your domains, and the service tells you about known vulnerabilities in the software you use, misconfigured domains and subdomains, and data breaches involving accounts in your domain.

I recommend it to every site owner in Poland, whatever else they use. You set it up once and the notifications arrive on their own.

ShieldWave sits next to it for when you want an answer straight away, in plain language, with an order of fixes and a brief you can pass on. Both look from the outside, so the results will partly overlap.

How often to scan

Once a month is enough for most small businesses. Scan more often when:

• something changes on the site: a new plugin, a new theme, a move to another host,
• a person or agency who had access to the admin panel leaves,
• you get a sign that something is off: a Google warning, a customer mentioning a strange redirect, spam sent from your domain. In that case also read the signs your website was hacked.

Check your site. Enter your address at shieldwave.io. It takes about 90 seconds and needs no password and no account.