Understanding findings

Every finding SiteCMD shows you has a severity, a confidence, and a status. Together they decide where the issue lives in the list, how much it pulls your score down, and what action makes sense next.

Severity

Severity is how bad the thing is if it’s real. Four levels:

Severity	What it means
Critical	The highest potential impact if the finding’s stated conditions are true. It receives the largest score deduction and warrants immediate review.
High	Material security, reliability, launch, or user harm that should normally be addressed before lower-severity work.
Medium	A meaningful defect, control gap, or quality problem whose impact is narrower or depends on additional conditions.
Low	Limited-impact information, defense-in-depth hardening, or a contextual improvement. It still counts while active, but receives the smallest deduction.

Severity is set by the check itself based on what it found. It’s not a guess at how much effort the fix will take.

Confidence

Confidence is how sure SiteCMD is that the finding is real. Three levels:

Confidence	What it means
Confirmed	Direct evidence is sufficient for the check’s narrowly worded claim. It does not imply every possible consequence is exploitable. Full weight in issue ranking; can satisfy the confidence gate for the security cap.
High	Strong automated evidence supports the stated claim, while a smaller amount of context may remain. Findings without an explicit confidence display as High, but only an explicit High satisfies the cap gate. 0.85× weight in issue ranking.
Needs review	The scanner observed a real pattern or partial condition, but applicability, value flow, runtime reachability, ownership, or effective configuration remains unresolved. 0.55× weight in issue ranking. Never triggers the cap.

Confidence describes the evidence for the finding as worded, not a universal probability that every impact in the issue is reachable. The one hard cap in the score additionally requires Critical severity and membership in a small cap-candidate list. Needs review findings never qualify. SiteCMD does not currently provide a control for manually changing confidence; review the evidence, fix and verify the issue, or mark it not applicable. The full eligibility rules are in The SiteCMD Score.

Status

A finding doesn’t sit in one state forever. Every issue has a status that controls whether it counts toward your active list and your score.

Status	What it means	Counts toward score?
New	Just discovered, or recently reopened. Shows in the active list.	Yes
Regressed	Was verified as fixed, then a later scan found it again. Back in the active list, flagged as a regression.	Yes
Ignored	Dismissed as not applicable. Hidden from the active list.	No
Blocked	Paused because you can’t act on it right now. Tracked under its own filter.	No
Verified	Confirmed fixed. Removed from the active list.	No

Only New and Regressed count toward your score. Ignored, blocked, and verified findings are excluded from active counts and the score calculation. This is a workflow rule, not a claim that blocked or ignored risk disappeared.

A “verified” issue is removed from your active list, but SiteCMD doesn’t take your word for it forever. The next time a scan runs the relevant check, the issue either stays verified (the check passes) or moves to Regressed (the check fails again). Regressed issues count against the score just like new ones, and they’re labeled as regressions so a fix that didn’t hold is impossible to miss.

A “blocked” issue stays out of the score while it’s blocked, but the Blocked filter on the Issues page shows you everything in that state at a glance. It’s a tracked-but-paused bucket: useful when something is genuinely out of your hands and you don’t want it polluting your active list, but you also don’t want to forget about it.

How findings are ranked

The Issues list sorts by severity first, then by impact within that severity. The impact ranking weight uses the severity base, confidence, whether the check emitted a failure or warning, and a bounded boost for repeated occurrences. It is a prioritization aid, not a second SiteCMD Score. This means:

• A confirmed critical sits above a needs-review critical.
• Every High sits in the High bucket ahead of Medium findings, regardless of confidence.
• Within the same severity and confidence, a finding observed on several pages ranks above a one-page occurrence, up to the occurrence-boost limit.

If you start fixing from the top of the list, you’re fixing the things that hurt your site most first. For working through findings instead of just picking the worst, see Triaging issues.