I Ran a Free Security Checkup on the Servers Behind My Websites. The Scary Score Wasn't the Real Story.

Two small computers in my house run everything I've built: the websites, the apps my family uses every day, and the tools I use for my clients. If someone broke into either one, it wouldn't just be my problem. It would be every business whose website lives there.

I'd done the obvious things over the years. Updates install every night, there's a firewall, and logging in needs a security key instead of a password. But I'd never had anything check my work from the outside in. Paid security audits can easily run into the thousands, and the free "website scanners" only look at the front door.

So I ran a free, well-known security checkup tool that inspects the whole machine: how it's set up, what's listening for connections, how logins work, and hundreds of other details. It gives a score out of 100 and a to-do list.

How the System Works

• A Full Inspection, Read-Only: The checkup only looks. It doesn't change anything, so it's safe to run on a server that's busy serving websites.
• A Score and a List: Each machine gets a hardening score plus warnings and suggestions. My main server scored 75 with no warnings. The one that hosts the websites scored 67, with 3 warnings and 54 suggestions.
• Check What's Actually Reachable: Before fixing anything, I compared every finding against what someone on the internet can actually reach. That step turned a scary list into a short one.

Overcoming the Friction

1. The List Looked Much Worse Than Reality

The website server had about ten different services listening for connections: file sharing, an old file-transfer service, a mail service, a TV streaming service. On paper, that's a lot of doors. But when I checked the firewall, only the website itself and the secured login were open to the internet. Everything else was either blocked or only reachable from inside my home network. A raw score treats every item the same. The real question is always "who can get to this?"

2. The One Real Gap Was Inside the House

The finding that mattered most wasn't an internet threat at all. Our family's shared photo and document folder let any device on our home network connect with full administrator rights. A smart TV, a guest's phone, or anything that picked up a virus could have done anything it wanted to those files. I changed it so devices still read and save normally, but nothing on the network can act as the administrator of that folder. Everyday use of the folder works exactly the same, which is the point.

3. A Cleanup That Could Have Broken Things

The checkup suggested removing dozens of leftovers from old updates. Most were exactly that: old versions taking up space. A few belonged to software the server still depends on, and removing them could have quietly deleted settings the running system still uses. I removed the true leftovers and left those alone. Following a security tool's advice blindly can cause the outage you were trying to prevent.

The Business Win

In one afternoon, at no cost, the website server went from 67 to 72. Logins are stricter, the system hides more of its inner details from anyone who gets a foothold, and the family folder is locked down. The websites never went offline while any of it happened. More important than the number, I now know exactly what the internet can reach and why.

If someone manages your website or your office computers, ask them one question: "What can someone on the internet actually reach, and when did you last check?" Next, I'm fixing my store's zero-reviews problem, because good visitors don't help much if nothing tells them other customers were happy.