Pricing
Free Scan
  • Security blog

Practical security insights for teams without a SOC

No vendor fluff. No recycled threat reports. Real guidance on vulnerability scanning, malware, and attack surface management — written by practitioners.

o

Obaida Al-Sulaiman

Information Security Manager · CISSP · CEH · OSCP

Website hacked what to do first: contain, copy, scope and clean, a four-step response order for the first 24 hours

Website Hacked? What to Do in the First 24 Hours

When your website is hacked, what to do first is contain it, copy it and only then clean it. This website hacked what to do guide gives the order for the first 24 hours: confirm the hack, take the site offline, rotate credentials, preserve evidence, scope the damage, choose between cleaning and restoring, and close […]
Read article
Iceberg showing what a remote scan sees above the waterline and files, database and scheduled tasks hidden below it ( Malware Scanner Says Clean but Site Hacked )

Malware Scanner Says Clean but Site Hacked: How to Find What It Missed

A clean malware scan is a report that says the scanner found nothing it recognizes, and it is not proof that a site is clean. When a malware scanner says clean but site hacked signs keep appearing, trust the signs, because attackers write code to pass the scanners owners run. This guide shows how to […]
Read article
Malicious redirects on websites: a visitor's address bar splitting into a safe page and a scam page

Malicious Redirects on Websites: Why They Happen and How to Remove Them

A malicious redirect is code that sends visitors from your page to a spam, scam or malware site without their consent. It often fires only for some visitors, which is why owners miss it, and it usually sits in the .htaccess file, a theme file, a JavaScript file or the database. Attackers plant it after […]
Read article
Japanese keyword hack cloaking: a normal page for the site owner and spam search results shown to Google

Japanese Keyword Hack: How to Detect, Remove and Recover

The Japanese keyword hack is a form of SEO spam in which attackers inject thousands of auto-generated Japanese pages into a compromised website. It works by cloaking: Google and search visitors see the spam, while you see your normal site. Owners usually find out from Japanese results in search or a sudden jump in indexed […]
Read article
What is a web shell: a hidden file on a web server that lets an attacker send commands from a laptop

What Is a Web Shell? How Attackers Control a Website Through One File

A web shell is a server-side script that an attacker can use to maintain remote access to a compromised web server. Depending on its capabilities and the privileges of the web server process, it may allow file access, command execution, database access, malware deployment or other administrative actions. Administration scripts that resemble web shells can […]
Read article
Deceptive Site Ahead warning explained with a browser alert screen and a request review button for site owners

Deceptive Site Ahead Warning: What It Means and How Site Owners Fix It

The Deceptive Site Ahead warning is a red Chrome screen that appears when Google Safe Browsing detects behavior associated with phishing or social engineering on a page. For visitors, it means leave. For site owners, it means Google detected harmful or deceptive behavior, and the cause may be hacked content, an injected script, a compromised […]
Read article
Six-step cleanup order to remove malware from a website: contain, copy, find, remove, close the entry point and verify

How to Remove Malware From a Website: A Cleanup Order That Holds

A website malware cleanup is the ordered process you follow to remove malware from website files and databases without leaving a way back in. It runs in six steps: contain the site, copy it, find every infected spot, remove it, close the entry point and verify. Most cleanups fail in the middle steps, because an […]
Read article
Command Injection Explained Infographic

What Is Command Injection? OS Command Injection Explained

Command injection, usually referring to OS command injection, is a security vulnerability in which attacker-controlled input changes an operating-system command executed by an application, allowing unintended command behavior or additional commands to run with the application’s privileges, The core trust boundary is straightforward: the attacker influences data, the application turns that data into part of […]
Read article
Exposed .env File Vulnerability

What Is an Exposed .env File Vulnerability? Risks & Fixes

An exposed .env file vulnerability occurs when a web server allows unauthorized users to retrieve an environment configuration file. A publicly accessible .env file can reveal database credentials, API keys, application secrets, cloud credentials, mail passwords, signing keys, and other configuration values that were intended to remain server-side.The severity depends on what the file contains […]
Read article
OWASP API Security Top 10

OWASP API Security Top 10 (2023): All 10 Risks Explained With Examples and Tests

The OWASP API Top 10 is a ranked list of the ten most critical API security risks, and the 2023 edition is still the current version. It covers broken authorization, broken authentication, resource abuse, server-side request forgery, misconfiguration, and unsafe use of third-party APIs. This guide explains all ten risks with an attack example, a […]
Read article
Vulnerability Scanning Tools

Top 10 Vulnerability Scanning Tools in 2026: Free and Paid Scanners Compared

The best vulnerability scanning tools in 2026 depend on what you need to scan. ScanTitan, Intruder, and HostedScan serve small teams that want cloud scanning without a security department, Tenable Nessus, Qualys VMDR, and Rapid7 InsightVM cover servers and networks, and Invicti, Burp Suite DAST, and Detectify test running web applications. This guide compares ten […]
Read article
What Is an Exposed Backup Files Vulnerability? Risks & Fixes

What Is an Exposed Backup Files Vulnerability? Risks & Fixes

An exposed backup files vulnerability occurs when a backup, database dump, old source-code copy, deployment archive, or editor-generated file is publicly accessible from a web server. Files such as config.php.bak, database.sql, site-backup.zip, or index.php~ can reveal source code, credentials, private data, and internal application details.The impact depends on what the backup contains. An obsolete static […]
Read article
Load more articles

Website Uptime Monitoring

This guide will tell you how to monitor your website availability and uptime by using ScanTitan free online website monitor. As the world evolves today, websites become an increasingly vital tool for businesses and end-users relying on the internet for work or pleasure. With an increase in websites, there is a need for website availability […]
Read article

Website Malware Scan

This guide will tell you how to scan your website against malware which includes viruses, webshells, malicious javascript and others by using ScanTitan free website malware scanner. What is website malware? Can a website be infected with malware too? Malware, is the short form for malicious software, is designed basically to cause harm to a […]
Read article

Website Vulnerability Scanner

This guide will tell you how to find your website security vulnerabilities and weakness by using ScanTitan free online vulnerability scanner. What is website vulnerability? According to research, it has shown on average that websites experience a cyber attack of over 25 times per day which implies over 9,000 attacks per year. Website vulnerability simply […]
Read article

Website Security Exposure

This guide will tell you how to reduce your website and online services attack surface by finding your security exposures using ScanTitan free online vulnerability scanner. What is website security exposure? With an increasing rate of cyber-attacks daily, there are various factors in which website security exposure is one that allows a website to become […]
Read article

Network Ports and Exposure Monitoring

This guide will tell you how to know your network exposure and running services on your edge device like a firewall or router and how to monitor network exposure using ScanTitan. What is network exposure monitoring? With the rate at which hackers are exploiting services behind open ports, it is very important to conduct network […]
Read article

Cyber Brand Monitoring

This article will guide you on how to monitor your cyber brand security using ScanTitan cyber brand monitoring to prevent digital image issues, traffic drops, and your customer trust loss. What is cyber brand monitoring? Cyber brand monitoring is very essential in your business if you want to consistently stand out, retain customers on your […]
Read article
What Is Vulnerability Intelligence

,

What Is Vulnerability Intelligence? A Practical 2026 Guide

Vulnerability intelligence is the process of turning raw vulnerability data into decisions about what to fix first. It combines CVE records with exploit activity, technical severity, affected products, patch status, threat context, and your own asset exposure. That matters more in 2026 because Verizon reports vulnerability exploitation as the initial access path in 31% of […]
Read article

Cyber Threat Intelligence

This guide will tell you what is cyber threat intelligence and how it is important to identify relevant threats of your business using ScanTitan Threat Intelligence platform. What is Threat Intelligence? Cyber threats keep increasing daily and it has become an essential issue for organizations and companies to deal with. Threat intelligence is simply the […]
Read article
Command Injection Explained Infographic

What Is Command Injection? OS Command Injection Explained

Command injection, usually referring to OS command injection, is a security vulnerability in which attacker-controlled input changes an operating-system command executed by an application, allowing unintended command behavior or additional commands to run with the application’s privileges, The core trust boundary is straightforward: the attacker influences data, the application turns that data into part of […]
Read article
Exposed .env File Vulnerability

What Is an Exposed .env File Vulnerability? Risks & Fixes

An exposed .env file vulnerability occurs when a web server allows unauthorized users to retrieve an environment configuration file. A publicly accessible .env file can reveal database credentials, API keys, application secrets, cloud credentials, mail passwords, signing keys, and other configuration values that were intended to remain server-side.The severity depends on what the file contains […]
Read article
OWASP API Security Top 10

OWASP API Security Top 10 (2023): All 10 Risks Explained With Examples and Tests

The OWASP API Top 10 is a ranked list of the ten most critical API security risks, and the 2023 edition is still the current version. It covers broken authorization, broken authentication, resource abuse, server-side request forgery, misconfiguration, and unsafe use of third-party APIs. This guide explains all ten risks with an attack example, a […]
Read article
Vulnerability Scanning Tools

Top 10 Vulnerability Scanning Tools in 2026: Free and Paid Scanners Compared

The best vulnerability scanning tools in 2026 depend on what you need to scan. ScanTitan, Intruder, and HostedScan serve small teams that want cloud scanning without a security department, Tenable Nessus, Qualys VMDR, and Rapid7 InsightVM cover servers and networks, and Invicti, Burp Suite DAST, and Detectify test running web applications. This guide compares ten […]
Read article
What Is an Exposed Backup Files Vulnerability? Risks & Fixes

What Is an Exposed Backup Files Vulnerability? Risks & Fixes

An exposed backup files vulnerability occurs when a backup, database dump, old source-code copy, deployment archive, or editor-generated file is publicly accessible from a web server. Files such as config.php.bak, database.sql, site-backup.zip, or index.php~ can reveal source code, credentials, private data, and internal application details.The impact depends on what the backup contains. An obsolete static […]
Read article
What Is XXE? XML External Entity Injection Explained

What Is XXE? XML External Entity Injection Explained

XML External Entity (XXE) Injection is a web security vulnerability in which an application processes attacker-controlled XML with a parser that is allowed to resolve external entities or other external XML resources. That unsafe parser behavior can expose local files, trigger server-side requests to internal or external systems, or create other unintended resource access. The […]
Read article
What Is a Directory Listing Vulnerability

What Is a Directory Listing Vulnerability? Examples & Fixes

A directory listing vulnerability occurs when a web server exposes a browsable index of files and subdirectories that were not intended to be discovered this way. Instead of returning an index page or denying access, the server generates a list that can reveal filenames, backup archives, configuration files, logs, source code, database exports, or internal […]
Read article
What Is IDOR? Insecure Direct Object Reference Explained

What Is IDOR? Insecure Direct Object Reference Explained

Insecure Direct Object Reference (IDOR) is an access control vulnerability in which an application uses a user-controllable reference to retrieve, change, delete, or otherwise act on an object without verifying that the requester is authorized to perform that action on that specific object.The central mistake is confusing authentication with authorization. Authentication answers “Who are you?” […]
Read article
What Is WordPress User Enumeration?

What Is WordPress User Enumeration? Risks & Prevention in 2026

WordPress user enumeration is the process of discovering information that identifies valid WordPress accounts, such as user IDs, display names, author slugs, author URLs, or whether an account exists. WordPress can expose some of this information intentionally through author pages, REST API responses, sitemaps, and login behavior. Enumeration does not bypass authentication and does not […]
Read article
CORS Misconfiguration

CORS Misconfiguration: Examples, Risks, Detection & Fixes

A CORS misconfiguration occurs when a web application allows an untrusted origin to read cross-origin responses that should only be available to trusted websites. Common causes include reflecting arbitrary Origin values, weak origin validation, trusting null, or allowing origins that attackers can control.Not every permissive CORS response is an exploitable vulnerability. The real risk depends […]
Read article
What Is CSRF? Cross-Site Request Forgery Explained

What Is CSRF? Cross-Site Request Forgery Explained

Cross-Site Request Forgery (CSRF) is a web security vulnerability in which an attacker causes a user’s browser to send an unintended request to an application that accepts the user’s automatically supplied credentials or authority. The browser may be authenticated, but the application fails to verify that the user actually intended the action.That distinction is the […]
Read article
WordPress Pharma Hack

WordPress Pharma Hack: How to Detect, Remove & Recover SEO

A WordPress pharma hack is a post-compromise SEO spam infection that adds pharmaceutical keywords, links, pages, redirects, or hidden content to a WordPress website without the owner’s permission. It is also commonly called a Viagra hack, pharmaceutical spam hack, or pharma SEO spam.The infection can be confusing because the website may look normal when you […]
Read article
Load more articles
Website hacked what to do first: contain, copy, scope and clean, a four-step response order for the first 24 hours

Website Hacked? What to Do in the First 24 Hours

When your website is hacked, what to do first is contain it, copy it and only then clean it. This website hacked what to do guide gives the order for the first 24 hours: confirm the hack, take the site offline, rotate credentials, preserve evidence, scope the damage, choose between cleaning and restoring, and close […]
Read article
Iceberg showing what a remote scan sees above the waterline and files, database and scheduled tasks hidden below it ( Malware Scanner Says Clean but Site Hacked )

Malware Scanner Says Clean but Site Hacked: How to Find What It Missed

A clean malware scan is a report that says the scanner found nothing it recognizes, and it is not proof that a site is clean. When a malware scanner says clean but site hacked signs keep appearing, trust the signs, because attackers write code to pass the scanners owners run. This guide shows how to […]
Read article
Malicious redirects on websites: a visitor's address bar splitting into a safe page and a scam page

Malicious Redirects on Websites: Why They Happen and How to Remove Them

A malicious redirect is code that sends visitors from your page to a spam, scam or malware site without their consent. It often fires only for some visitors, which is why owners miss it, and it usually sits in the .htaccess file, a theme file, a JavaScript file or the database. Attackers plant it after […]
Read article
Japanese keyword hack cloaking: a normal page for the site owner and spam search results shown to Google

Japanese Keyword Hack: How to Detect, Remove and Recover

The Japanese keyword hack is a form of SEO spam in which attackers inject thousands of auto-generated Japanese pages into a compromised website. It works by cloaking: Google and search visitors see the spam, while you see your normal site. Owners usually find out from Japanese results in search or a sudden jump in indexed […]
Read article
What is a web shell: a hidden file on a web server that lets an attacker send commands from a laptop

What Is a Web Shell? How Attackers Control a Website Through One File

A web shell is a server-side script that an attacker can use to maintain remote access to a compromised web server. Depending on its capabilities and the privileges of the web server process, it may allow file access, command execution, database access, malware deployment or other administrative actions. Administration scripts that resemble web shells can […]
Read article
Deceptive Site Ahead warning explained with a browser alert screen and a request review button for site owners

Deceptive Site Ahead Warning: What It Means and How Site Owners Fix It

The Deceptive Site Ahead warning is a red Chrome screen that appears when Google Safe Browsing detects behavior associated with phishing or social engineering on a page. For visitors, it means leave. For site owners, it means Google detected harmful or deceptive behavior, and the cause may be hacked content, an injected script, a compromised […]
Read article
Six-step cleanup order to remove malware from a website: contain, copy, find, remove, close the entry point and verify

How to Remove Malware From a Website: A Cleanup Order That Holds

A website malware cleanup is the ordered process you follow to remove malware from website files and databases without leaving a way back in. It runs in six steps: contain the site, copy it, find every infected spot, remove it, close the entry point and verify. Most cleanups fail in the middle steps, because an […]
Read article

Written by

o

Obaida Al-Sulaiman

Information Security Manager, Dubai

CISSP
CEH
OSCP

12+ years in information security. Specialises in web application security, vulnerability management, and external attack surface reduction for SMB and mid-market organisations.

View all posts

Browse by topic

Website Security Guide
Vulnerability Scanning
Malware & Website Security
Attack Surface Management

Browse by topic

New CVEs, practical guides, and scan methodology updates. One email per week. No sales pitch.
No spam. Unsubscribe any time. GDPR compliant.

Editorial standards: All ScanTitan blog content is reviewed by certified InfoSec professionals before publication. Technical claims are tested against live scan results or cited from primary sources (CVE database, OWASP, NIST NVD). We do not accept sponsored posts or paid placements.

Try a free scan

Run a free vulnerability scan on your domain. No account required.
Scan my website
Loading posts...