Security guides

A scan found something and you want to know what it means? Each guide explains one common finding in plain language: why it matters, how to confirm it, and the steps to fix it. Ordered from most to least urgent.

1. High

   Port 3389 (Remote Desktop) is open

   Remote Desktop reachable from the internet is a top ransomware entry point. How to close it or put it behind a VPN.

2. High

   FTP port 21 is open

   Plain FTP sends passwords and files unencrypted. Where it comes from (NAS, printers, hosting) and how to switch to SFTP.

3. High

   SMB port 445 (Windows file sharing) is open

   The port WannaCry spread through. How to block it, turn off SMBv1, and give staff safer remote access to shared files.

4. High

   Telnet port 23 is open

   Unencrypted logins on cameras, routers and printers, and how the Mirai botnet spread. Which device it is and how to turn Telnet off.

5. High

   VNC port 5900 (remote desktop) is open

   Full screen control, sometimes with no password at all. How to check, close it, and connect safely through a VPN or SSH tunnel.

6. Medium

   Database port open to the internet

   MySQL, PostgreSQL, MongoDB or Redis reachable from anywhere. How to lock each one down and connect safely through a tunnel.

7. Medium

   Weak SSL/TLS settings (TLS 1.0, weak ciphers, Heartbleed, POODLE)

   The encryption behind the padlock is weaker than it looks. What each TLS finding means, and settings for Apache, nginx and Windows/IIS.

8. Medium

   Outdated OpenSSH or Apache found

   Your server's version matches published vulnerabilities. How to check whether they're already patched, and update safely.

9. Medium

   Missing Content-Security-Policy (CSP) header

   Your site has no safety net if a malicious script gets in. A starter policy and how to roll it out without breaking anything.

10. Medium

    Directory listing enabled ("Index of /")

    Anyone can browse lists of your website's files, including backups and private uploads. How to turn it off on Apache, nginx, IIS and WordPress.

11. Medium

    Absence of anti-CSRF tokens

    Forms another site could submit on a logged-in user's behalf. When it's a false alarm, and how to turn on protection in WordPress, Django, Laravel, Rails, ASP.NET and Express.

12. Low

    Cookies missing HttpOnly, Secure or SameSite

    What each cookie flag does, which cookies need them, and settings for PHP, WordPress, Node.js, Django, ASP.NET, Apache and nginx.

13. Low

    Missing HSTS (Strict-Transport-Security) header

    One header that makes browsers always use HTTPS. Copy-paste settings for Apache, nginx, IIS, Cloudflare and Node.js.

14. Low

    Server leaks version information

    Your web server announces its exact software version. How to hide it on Apache, nginx, IIS, PHP, Express and WordPress.