What is a vulnerability scan? The short answer
- A vulnerability scan is an automated check of your website or server for known security weaknesses, so you can fix them before an attacker finds them.
- It is not a penetration test. A scan lists weaknesses broadly; a penetration test is a person trying to break in and seeing how far they get.
- Scans come in two main kinds: network (or platform) scans that look at the server itself, and web application scans that look at the pages and features of your site.
- New vulnerabilities are published every day, so a scan once a year leaves long gaps. Frequent automated scans close them.
- Only scan systems you own or have written permission to test.
What is a vulnerability?
A vulnerability is a weakness in software or its settings that someone could use to do harm. The US standards body NIST describes it as a weakness that can be exploited or triggered to produce an adverse effect.
Think of your server as a building:
- An old lock: software that has not been updated in years. The way to open it is public knowledge.
- An unlocked window: a service or admin page reachable from the internet that nobody remembers leaving open.
- A key under the mat: a backup or settings file sitting where anyone can download it.
Having vulnerabilities is normal. Flaws are found in all software over time. The real problem is a weakness the owner does not know about.
What does a vulnerability scan actually do?
- 1
Takes an inventory
It finds which doors (ports) are open on your server and which software, in which version, is answering.
- 2
Compares against known weaknesses
Each version and setting is matched against lists of publicly known vulnerabilities.
- 3
Checks the configuration
Encryption (SSL/TLS) settings, certificate expiry, files that should not be public, missing protective settings.
- 4
Writes a report
Findings are sorted by severity, each with an explanation and a fix.
A scan finds problems. It does not fix them. The job is done only when you have fixed the finding and scanned again to confirm.
Types of vulnerability scans
Three questions sort out the jargon: what is tested, who tests it, and from where.
| Question | Type | What it covers |
|---|---|---|
| What | Network / platform scan | The server and network devices: open ports, the operating system, and server software such as the web server or database (middleware). |
| What | Web application scan | The site itself: forms, login, shopping cart. Looks for coding mistakes that leak or change data. |
| Who | Automated (tool) | Software runs fixed checks. Fast, cheap, repeatable. Strong on known weaknesses. |
| Who | Manual | A specialist explores the site by hand. Finds design mistakes tools cannot see. Slower and more expensive. |
| Where | External | From the internet, as an attacker sees you. Covers only what is exposed. |
| Where | Internal (authenticated or agent-based) | From inside the machine, using a login or a small read-only program. Sees installed software and missing updates. |
For a brochure site or a WordPress site, an automated external scan is the sensible first step. If you have built your own features, such as accounts or payments, add manual web application testing.
Vulnerability scan vs. penetration test
| Vulnerability scan | Penetration test | |
|---|---|---|
| Purpose | List as many weaknesses as possible | Prove whether a real attack reaches a defined goal |
| Who does it | Mostly software | Skilled people, by hand, with tools |
| Depth | Wide and shallow; confirms, does not exploit | Narrow and deep; exploits and moves further in |
| Frequency | Monthly, weekly or daily | Yearly, or after major changes |
| Cost level | Low to moderate | High |
Neither replaces the other. The efficient order is to clear the obvious weaknesses with scans first, then pay for a penetration test if your customers, insurer or regulator require one. For typical prices, see vulnerability scan vs. penetration test cost.
How to read a scan report: CVE and CVSS
A report lists each weakness, where it is, how severe it is, what could happen, and how to fix it. Two abbreviations appear everywhere.
CVE: the ID number
Each publicly disclosed vulnerability gets a worldwide ID in the form CVE-year-number, such as CVE-2025-12345. Search the ID to find vendor advice on the same flaw.
CVSS: the severity score
A common scale from 0.0 to 10.0, maintained by the international group FIRST: Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0.
Fix from the top down. Keep in mind that the score rates the flaw itself, not your situation. A Medium finding on a server that faces the internet can deserve attention before a High one on a machine nobody can reach.
How often should you run a vulnerability scan?
An annual scan is better than none, but it is a snapshot. According to the CVE Program's own metrics, 48,244 CVE records were published in 2025, about 130 a day. A flaw announced the day after your scan stays invisible until the next one.
- Continuous automated scans (weekly to daily) to catch new vulnerabilities and configuration changes.
- A scan after every significant change: new server, redesign, new feature.
- Manual testing about once a year if you run custom-built features.
Security Ready covers the first of these. It runs an external scan weekly, lighter checks of certificates, DNS and headers daily, and matches newly published vulnerabilities against your software twice a day.
What a vulnerability scan cannot find
A clean report means nothing was found in what was checked. It is not a guarantee.
- Business-logic flaws: one customer viewing another's orders, a discount applied twice. The software works as written, so a tool sees nothing wrong.
- Anything behind a login, unless the scan is given credentials.
- Unknown flaws: a weakness nobody has published yet is on no list to compare against.
Security Ready is an automated scanner and shares these limits. It does not do penetration testing, deep testing behind logins, business-logic testing, or anything likely to take a site down.
How to get started
- 1
List what you have
Write down your website address, your email domain, and anything reachable from outside, such as a VPN or remote access.
- 2
Confirm you may scan it
If a hosting company or agency manages the server, check their terms or ask first.
- 3
Run one free scan
Enter your URL and email for a free in-depth scan. Results and a PDF report arrive in 30 to 60 minutes.
- 4
Fix Critical and High first
Follow the fix instructions, or forward the report to whoever maintains the site.
- 5
Re-scan, then keep watching
Confirm each fix with a re-scan, then switch to scheduled scans.
The step-by-step guide shows each screen.
Only scan systems you own or have explicit permission to test. Scanning or probing someone else's systems without authorization can break computer misuse laws in many countries, and often the provider's terms of service too.
Frequently asked questions
Is a vulnerability scan the same as a vulnerability assessment?
People use the terms loosely. Strictly, the scan is the automated check, and the assessment is the wider process of scanning, reviewing the results and deciding what to fix first. When comparing quotes, ask what is tested, from where, and by whom.
Will a scan slow down or break my website?
A normal scan sends traffic similar to ordinary browsing, so problems are rare. Old devices or very small servers can struggle. If you are worried, run it at a quiet time.
Do I need a scan if I use shared or managed hosting?
Your host looks after the operating system, but WordPress, plugins, uploaded files, and your domain and email settings are yours. Those still need checking. Read your host's policy on scanning first.
Are free vulnerability scanners good enough?
They are a good start. The differences are usually the number of checks, how clearly results are explained, and whether anyone keeps watching after the first run.
Does a scan make me compliant?
It depends on the standard. Many frameworks and cyber insurance questionnaires ask for regular scanning, and some also require a penetration test. Check the exact wording you have been given.
What should I do if the scan finds something critical?
Do not panic, and do not ignore it. Read the fix: most critical findings are solved by an update or by closing access that should not be public. Then re-scan to confirm.
See where your own site stands — free
The free in-depth scan checks your site from the outside against thousands of known weaknesses and tells you how to fix each one. No payment details needed. For businesses; scans only with the owner's authorization.