Fixing what the scan finds

1. Close ports you did not mean to expose#

Every open port is an entry point someone can reach without credentials. Databases, cache servers, container APIs and admin panels rarely need to face the internet. Bind them to localhost or a private interface, or put them behind a VPN or a Cloudflare tunnel.

Re-run the scan after changing firewall rules. An external scan is the honest check on whether the rule took effect.

2. Remove exposed files#

A reachable .env or .git directory hands over credentials and source history. Fix it at the web server level, not only by deleting the file, because deployment can restore it.

3. Replace default credentials#

Default logins are found by scanners within hours of a service being exposed. Change them, then confirm the old pair no longer works.

4. Patch the CVE matches#

CVE findings are matched to the version banner nmap detected. Patch the service, restart it so the new version is actually serving, then re-scan to confirm the match is gone.

5. Fix TLS configuration#

Weak ciphers, expired certificates and misconfigured chains show up in the nuclei checks. These are usually a configuration change rather than a code change.

Re-scanning#

The free tier allows one scan per IP per 24 hours. Full Pro allows one per hour, which is the practical fit for a remediation loop where you change something and want to confirm it. See Scan tiers.

Next#

• Data retention
• Back to the index