What Does a Website Vulnerability Scan Actually Check?

Security vendors love the word 'scan,' but few explain what a scan actually does. Understanding what's being checked makes the results meaningful — and helps you judge whether any security product is earning its keep.

Known vulnerability matching

The core of every scan. Security researchers maintain public databases of documented flaws — tens of thousands of them, each with an identifier and severity score. A scanner fingerprints the software your site runs (platform, version, plugins, server software) and cross-references it against the database. If your version has a documented hole, the scan flags it with its severity.

Injection and input testing

The scanner probes your forms, search boxes, and URL parameters the way an attacker would — sending crafted inputs designed to leak database contents or execute scripts — and watches how your site responds. Passing means your inputs are properly validated; failing pinpoints exactly which field is exploitable.

Malware and defacement detection

The scan examines your rendered pages for injected code: hidden iframes loading content from malicious domains, obfuscated scripts, spam links stuffed invisibly into your pages, redirects that only fire for certain visitors. This catches compromises that are invisible when you look at your own site.

Configuration and certificate checks

Expired or misconfigured SSL certificates, exposed admin panels, directory listings left open, missing security headers, server information leaks. Individually small; collectively the difference between a hardened site and an easy target.

Why frequency beats depth

Here's the part most people miss: a perfect scan is obsolete the day after it runs. New vulnerabilities are published daily, and your site changes with every update and new plugin. An annual deep audit tells you about last year. Daily scanning tells you about today — and today is when the bots are probing.

Trust Guard runs these checks against your site automatically every day and emails you only when something needs attention. See your first scan report free — most owners are surprised by what it finds.