Learn
Guides on website security scanning
Short, practical reading for people who look after other people's websites. Each guide answers a question we kept hearing from agencies and consultants while designing ScanBastion, and none of them require the product to be useful.
New guides are announced in the RSS feed. If there is a question you would like covered, tell us.
Severity, confidence, verification: how to read a vulnerability scanner finding
Why a vulnerability scanner finding needs three separate fields, what each one means, and how to triage a report without over- or under-reacting.
How DNS TXT domain verification works, and why scanners require it
A plain explanation of DNS TXT record verification: what the record proves, how to add one for a client domain, common mistakes, and what it does not prove.
Why automated vulnerability scanners report false positives, and what to do about them
The main causes of false positives in web vulnerability scanning, how to tell a real finding from a mistaken one, and a triage routine that keeps client reports credible.
HTTP security headers explained for agency developers
The eight response headers that matter on a client website, what each protects against, a safe starting value for each, and the ones that will break a site if set carelessly.
What a website vulnerability scan does and doesn't cover
An honest map of what external, unauthenticated scanning can detect, what it structurally cannot, and how to explain the difference to a client.
Passive vs active scanning: what each one sends to your website
The difference between passive and active vulnerability scanning in terms of the actual traffic a site receives, the risks of each, and when each is appropriate.