Read the evidence.
Choose the next step.

Start with severity and context

Investigate higher-severity findings first. Read the affected URL, component and observed detail. A publicly exposed version may be inferred from cached assets and should be confirmed in your administration tools.

Check freshness

Look for the last validated check. A provider outage can leave an earlier finding visible until a successful lookup is possible. Old evidence should not be described as a new verification.

Confirm before changing

Compare the finding with your hosting, WordPress and plugin settings. Use trusted vendor guidance. Do not paste credentials or customer records into an AI tool or support message.

Back up, change, check

Make a restorable backup before a website change. Test navigation, login, cart and the checkout page without placing a real order. If a payment integration needs testing, use its documented test environment.

Rescan and keep a note

Run the relevant check again. Record what you changed and what the new result shows. Never disable security protections just to make a warning disappear.