If you take card payments, your bank or payment provider may ask you to pass a regular PCI scan from a company such as SecurityMetrics, Trustwave or SecureTrust. These scans check your website and the server it runs on.
Most findings we see on Wordify servers are false positives. We can give you the evidence your scan vendor needs to clear them.
What to do when a scan fails
Download the full scan report (usually a PDF) from your scan vendor's portal.
Send it to Wordify Support with your site's domain and the date you need it cleared by.
We check each finding against your server and reply with a letter you can forward to the scan vendor. It lists the exact software versions on your server and the security fix for each issue.
Submit the letter to your scan vendor. Most vendors call this a dispute, an exception request or a false-positive request.
If the vendor has follow-up questions, add [email protected] to the email thread so we can answer them directly.
Scan vendors usually won't discuss your account with us unless you ask them to. Copying us into the thread is the easiest way to do that.
Why scans flag servers that are already patched
Most scans don't test whether a vulnerability can be exploited. They read the version number a service announces, compare it with a list of known issues, and report every issue fixed in a later version.
Wordify servers run an enterprise Linux operating system compatible with Red Hat Enterprise Linux (CloudLinux or Rocky Linux). On these systems the vendor fixes security issues by patching the version already installed, instead of moving to the newest release. This is called backporting. The fix is installed, but the version number the service announces doesn't change.
For example, the SSH service on many of our servers announces itself as OpenSSH_9.9. A scanner compares that with the newest OpenSSH release and reports a list of vulnerabilities. The installed package is actually openssh-9.9p1-12, and the -12 release contains the security fixes the scan is asking for. That part of the version is never visible to a scanner.
Installing the newest upstream version isn't possible on these systems, and it isn't needed. The vendor's patched package is the supported fix.
What we send your scan vendor
The letter is written for your server and your report. It usually includes:
The server's operating system and release.
The full installed package version, for example
openssh-server-9.9p1-12.el9_8.alma.1. This is the "full backported version" most vendors ask for.For each CVE in your report, the vendor security advisory that fixed it and the matching entry from the package changelog.
Confirmation that the vendor has no newer package available, so the server is fully up to date.
For any CVE that isn't patched yet, or doesn't affect a web server (for example a flaw in the SSH client program), an explanation of why and the protections in place.
SecurityMetrics and other vendors have accepted this evidence to clear OpenSSH findings for Wordify customers.
Common findings and how they're resolved
OpenSSH or other server software "out of date"
This is the most common finding by far. Send us the report and we'll prepare the evidence described above. You don't need to run anything yourself. Running ssh -V on your own computer shows your computer's SSH version, which isn't what the scan tested.
TLS 1.0 or TLS 1.1 enabled, weak ciphers, or a low SSL grade
Wordify sites and email services accept only TLS 1.2 and TLS 1.3. If your scan reports TLS 1.0 or 1.1:
Check whether your domain uses Cloudflare or another proxy service. If it does, the scan tested the proxy. In Cloudflare, go to SSL/TLS, then Edge Certificates, and set Minimum TLS Version to TLS 1.2.
If your domain doesn't use a proxy, send us the report and we'll check the server.
Missing security headers or clickjacking
Wordify adds these security headers to every site by default:
Strict-Transport-Security (HSTS), set to one year
X-Frame-Options set to SAMEORIGIN, which protects against clickjacking
X-Content-Type-Options set to nosniff
Content-Security-Policy set to block mixed content
Referrer-Policy and Permissions-Policy
If your scan asks for stricter values, such as a full Content Security Policy or HSTS with includeSubDomains, contact us. Please don't add the same headers with a WordPress plugin as well. Sending a header twice can confuse browsers and scanners, and a strict Content Security Policy can break parts of your site if it isn't set up carefully.
Weak SSH algorithms, such as hmac-sha1 or CBC ciphers
SSH on every Wordify server offers only modern algorithms: SHA-2 based message authentication codes (MACs) and GCM, ChaCha20 or CTR ciphers. SHA-1 MACs such as hmac-sha1 and CBC ciphers such as aes256-cbc are turned off.
If your scan still reports them, check that it scanned the IP address of your Wordify server. A scan of an old IP address, or of another server that also hosts your domain, can show results that don't apply to us. If the IP matches, send us the report and we'll look into it.
Open ports, such as FTP, email or database ports
Wordify servers run email and file transfer services, so some ports are open on purpose. Send us the report and we'll confirm which services are reachable and why.
Findings about your website
Some findings are about WordPress itself: an outdated plugin, an old WordPress version, or a leftover test file. These are fixed on your site, not on the server.
Update WordPress, your plugins and your theme. Automated Safe Updates can do this for you.
Delete test files such as
phpinfo.phporinfo.phpfrom your site files.Ask your scan vendor to rescan.
Check which PCI questionnaire applies to you
If your site uses a hosted payment page or an embedded payment form from Stripe, PayPal, Square or a similar provider, card details go straight to the payment provider and never pass through your site. Ask your payment provider which PCI self-assessment questionnaire (SAQ) fits your setup. Some customers have found that answering the right questionnaire changed what they needed to scan.
Planning a penetration test
If a security company is going to test your site, tell us before the test starts. Include:
The name of the company running the test.
The IP addresses they'll test from.
The dates and times of the test.
What they'll test, for example the website only, or the website and email.
Our firewall blocks traffic that looks like an attack, and that can stop a test partway through.
What Wordify can and can't provide
We can:
Confirm in writing how your server is configured and patched.
Answer your scan vendor's questions about the server.
Review each finding and tell you whether it's a server issue or a site issue.
We can't:
Complete your PCI questionnaire or provide an Attestation of Compliance for your business. Your PCI compliance is between you, your payment provider and your scan vendor.
Install software versions the operating system vendor doesn't supply, such as the newest upstream OpenSSH release.
Need help?
Contact Wordify Support from Support in Console, or email [email protected]. Our team replies within an hour, 24/7. Evidence letters can take a little longer, because we check each finding against your server.