I have had my boss do vulnerability scans on our servers using online services and it's frustrating trying to explain that we don't actually suffer from the vulnerabilities that the reports say we do.
Am I kidding myself or am I right in saying that these services "assume" because you allow posting to your site that it's vulnerable? I've tested a bunch of injection attacks and our server returns never allows them to execute because the code stops it.
What is the best way to make my server immune to these scans? I get a few things, like stopping apache/php/openSSL from reporting it's versions, especially because I use security patched versions from the Debian security team which doesn't necessarily match the patched version for PHP.