If you got an email from PatchNotice

If it came from notice@patchnotice.org, yes. A real notice names your domain, quotes exactly what was observed and where, and lists CVE numbers you can look up yourself on nvd.nist.gov. It never has attachments and never asks for a password, money or access. If an email claiming to be from PatchNotice does, it isn't genuine, and you can forward it to notice@patchnotice.org.

Your website shows which version of some software it runs, for example a CHANGELOG.txt saying Drupal 7.57, or a Server header saying Apache/2.4.52. Public security databases list known security holes in that version, and the email names them.

It is not a claim that anyone has broken in, or that the hole definitely works on your site. Where a hole is in CISA's Known Exploited Vulnerabilities catalog, the email says so, because those are being used in real attacks.

Update the software the email names, or forward the email to whoever looks after your website. You don't need to reply.

No. The scanner made a handful of ordinary requests, the same ones a browser makes when it opens your homepage, plus requests for public files such as readme.html and security.txt. No exploits, no logins, no forms, and no check of whether any hole works. The full list is on How it works.

From your own website: the Contact line in your /.well-known/security.txt, or, if it has none, the address on your contact page. A site that publishes neither gets no email. No bought lists, no guessed addresses and no mailing list. You get one email per domain, and that's it.

That happens. Version-based matching can be wrong. Linux distributions such as Debian, Ubuntu and Red Hat backport security fixes without changing the version number, so a server can report a vulnerable version and still be patched. A notice may occasionally reach an operator who has already fixed the problem. When the version string points to a distribution build, the notice says so and marks those CVEs as conditional.

Then there's nothing to do. The scanner doesn't come back to check, so you won't get a follow-up. If you want to point out the mistake, reply: replies are forwarded to me and help improve the matching.

No. Each domain is visited once and goes into a ledger, so the scanner never comes back on its own and you won't get a second email about the same thing.

Reply “stop”, use the unsubscribe link in the email, or use the opt-out page. Each one works automatically and immediately: the domain and its subdomains are removed from scanning and email permanently, and a “stop” reply gets a confirmation.

Most hacked websites are hacked through known vulnerabilities in outdated software, and most owners would update if they knew. Nothing is for sale; the email is the whole interaction.

The software versions observed, the CVEs they matched, and the contact address your site publishes. Nothing about people. Findings about a site go only to its owner and are never published; the numbers are totals and never name a domain.

Write to notice@patchnotice.org: a mistake in an email, a scanner that behaved differently from what this site describes, or a security issue in this website. The same address is in /.well-known/security.txt.