IsMyCodeSafe Report: False Positives Explained

False positive 5: two different lists of open ports

IsMyCodeSafe says, in "Open Ports": 25 (SMTP), 8443 (HTTPS-alt) and 22 (SSH). Further down, in "Shodan Intelligence": 80, 443 and 8443.

The facts: the same report gives two different lists for the same server. One leaves out the web ports the site actually runs on, and the other leaves out the mail and SSH ports.

False positive 6: a grade A with three failing grades

IsMyCodeSafe gives an overall grade of A, "Excellent. Minimal issues found", while its own SEO and AI Search sections are graded E and its AI Content section is graded C. A summary grade that ignores three of its own sections does not tell a reader much.

What the scan got right

To be fair, several findings are correct:

• Security headers 7 out of 7, a valid TLS 1.3 certificate, SSL 2, SSL 3, TLS 1.0 and TLS 1.1 all disabled, no Heartbleed, and SPF, DMARC, DKIM, CAA, MTA-STS and TLS-RPT all present. All correct.
• The server's IP address is clean on the blacklists it checked.
• SSH (port 22) and the server control panel (port 8443) can be reached from the internet, and OCSP stapling is not enabled. These are real settings, not errors, and are worth reviewing.

Summary

IsMyCodeSafe's security checks are mostly accurate, but its SEO, AI content and AI search grades rest on reading 12 words from a 4,846-word page. On top of that, it reported compression as off when Brotli is on, called three standard public files "sensitive", flagged a search box for missing CSRF protection, gave two different lists of open ports, and gave an overall A while grading three of its own sections C and E. Check any scan against your own server before you act on it.

Frequently asked questions

What is IsMyCodeSafe?

IsMyCodeSafe is an online scanner at ismycodesafe.com that checks a website for security problems, including security headers, SSL and TLS, open ports, DNS and email records and blacklists. It also grades SEO, AI-generated content and AI search readiness, and offers paid detailed reports and monthly scans.

Why did IsMyCodeSafe give my site a bad SEO grade?

In this case its SEO and AI search grades were based on reading 12 words and 11 KB from a home page that has 4,846 words and 115 KB of HTML. The server log showed the full page was sent with HTTP 200 for every request during the scan. If a scan reports a word count far lower than your page has, its content grades do not describe your page.

Are robots.txt, sitemap.xml and security.txt sensitive files?

No. All three are meant to be public. robots.txt tells search engines and AI crawlers which pages they may crawl, sitemap.xml lists your pages for search engines, and security.txt is a standard (RFC 9116) for telling researchers how to report a security problem. A scanner that flags them as sensitive is giving a false positive, and you should not remove or hide them.

Does a search form need CSRF protection?

No. CSRF protection is for forms that change something on the server, such as a login, a payment or an account setting. A site search form that uses the GET method only sends a search word to a results page and changes nothing, so it does not need a CSRF token. Flagging it as an authentication failure is a false positive.