Anwar Site Guardian

Back to audit

Guide

Vulnerability Scanning for Small Websites — A Plain-Language Guide

If you run a small business site, a landing page or a client project built with an AI development assistant, you probably don't have a security team. This guide explains what vulnerability scanning is, why it still matters, and how Anwar Site Guardian helps you stay on top of it in a few minutes a month.

What is vulnerability scanning?

Vulnerability scanning is the act of checking a website for known weaknesses before an attacker does. A defensive scan (what this tool does) only reads public information the site already exposes: robots.txt, sitemap.xml, llms.txt, HTTP response headers, and the list of routes you publish. It never tries to log in, guess passwords, or trigger real exploits.

Offensive scanning — brute forcing forms, probing databases, exploiting bugs — is a separate discipline that requires written permission and specialised tools. It is out of scope here on purpose.

Why small business websites still need it

  • Bots scan the entire public internet every day. Small does not mean invisible.
  • The most common issues on small sites are trivial: an admin page listed in the sitemap, missing security headers, contact data leaked publicly, or a robots.txt that reveals private paths.
  • Search engines and AI assistants both read the same signals. Good hygiene improves SEO and AI discoverability at the same time.
  • Fixes are usually a five-minute edit, not a rewrite.

What Anwar Site Guardian checks

  • SEO signals: robots.txt directives, sitemap.xml URL list, indexable routes, sensitive paths accidentally listed.
  • Security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP.
  • AI discovery: presence and quality of llms.txt so AI assistants can describe your site accurately.
  • Manual checklist: admin protection, login paths, draft visibility, leaked contact data, Supabase RLS, 404 handlers.
  • Reports: a full technical report, a founder-friendly client summary, and a ready-to-paste AI fix prompt.

What it does not replace

This tool is a hygiene check, not a full penetration test. If your site handles payments, personal data, medical or legal information, complement it with a professional pentest, dependency scanning, and monitoring. Anwar Site Guardian is designed to catch the boring 80% so a specialist can focus on the interesting 20%.

Simple monthly checklist

  1. Run the audit on your production domain.
  2. Confirm the overall risk is Low or Medium.
  3. Open sitemap.xml and robots.txt — no admin, staging, or private routes listed.
  4. Check the HTTP security header score is 60% or higher.
  5. Confirm llms.txt exists and describes your site clearly.
  6. Read the client summary and share it with the site owner.
  7. Apply the AI fix prompt for any Critical or High findings.

Frequently asked questions

Is vulnerability scanning the same as hacking?

No. Defensive scanning only reads public information the site already exposes (like robots.txt, sitemap.xml and HTTP response headers). It does not try passwords, exploit code, or attack forms.

Do I need this if my site is small?

Yes. Small sites are usually scanned automatically by bots looking for easy wins: exposed admin pages, missing security headers, or contact data leaked in a sitemap. A short monthly check catches most of these.

Will it slow my site down?

No. Anwar Site Guardian fetches only a handful of public files (sitemap, robots, llms, homepage headers). It behaves like any well-mannered crawler.

Does it replace a real security audit?

No. It replaces the boring checklist part. For payment platforms, login flows or regulated data, hire a professional pentester in addition to running these checks.

Ready to run a check?

Open the audit tool and paste your domain — it takes under a minute.

Run an audit