Example finding
This is what a finding from a real check looks like.
One finding, exactly as it comes out of the check: with a name, a severity, an explanation of what's wrong, and instructions on how to fix it.
Services that hold data are not meant for the public internet — the site reaches them from the inside, on the same server. Some such services historically have no password until someone explicitly sets one, so whoever finds them open can often read and delete them without a single password. The bots that hunt for them sweep the whole internet continuously — it isn't a question of whether they'll arrive, but when.
I only checked whether the port was open. I did not try to connect or read anything.
Close them off from the internet. They should listen only on 127.0.0.1 if they're on the same server as the site. MySQL: bind-address = 127.0.0.1. If something is public on purpose because it connects from another location, it needs a firewall that admits only that address, and an encrypted connection — that's no longer a click in a panel.
The finding is complete, with name and version, and it's yours to forward to anyone. There are usually several of these in one scan — from open ports and spoofable email to outdated plugins.