The Scan sees everything a burglar would see from the street. What’s behind the walls, it doesn’t.
Picture someone strolling around your house. They check whether a window is open, how old the lock is, and whether the spare key is under the doormat. They don’t go in, they just look. Exactly what burglars do, at hundreds of houses a day.
That’s how the Scan spots outdated plugins and themes, your WordPress version, the padlock in the browser, sensitive files left out in the open, and how well your login is protected. It also checks whether your business email is drifting towards the spam folder, and whether your domain has landed on a blocklist.
What it can’t see: who your administrators are, whether two-step login is switched on, or whether malware is hiding among your files. For that you have to go inside the house, and that’s a job for the Security Lockdown.
In short: it looks from the outside, at the same things attackers look at. What’s inside is measured by the Security Lockdown.