Rod,

there is no word about which version of DNN is (or hopefully was) in use. But FCK Editor has not been supported on DNN since - I don't know, but my guess is DNN 5. (Telerik) RadEditor was in use then, and since DNN 7 it is CK Editor. I therefore suspect that the issue is that the investigated site has not been updated for years.

This is a risk, we all should know. But: Just updating is not enough. Many extensions (modules, skins,...) may (or will) break, esp. when you upgrade - even in steps - from DNN 4 to 9, even from 7 to 9. Therefore it is better to invest in a hosting company that will check everything and make the necessary updates of the modules and other extensions as well. Even if this could be a bit more expensive.

And: There is more to security than the security advisor, upgrades and activating https. Have you ever checked your site with https://securityheaders.io, https://www.ssllabs.com/ssltest/ or similar tools? Have you implemented a content security policy (CSP)? Have you secured the database access, or is the user running the site in the databases's db_owner or SQL Server's Sysadmins role? etc. etc.

Happy DNNing!
Michael

---