We have installed patches to out Magento sites (v1.9, patches 1533 5994 and 6285 (both versions)). However, despite installation reported successful, and after taking note of steps in Applied Patches but still getting a vulnerable message? We are still being told by http://magento.com/security-patch that the site is vulnerable. Checking on https://templates-master.com/supeechecker lists the 3 patches we have applied as those missing. Is there any other steps that are required, but not mentioned in the post mentioned above?
You missed the one patch that addresses the "Shoplift" exploit SUPEE-5345 And this is the only one that the byte shoplift tester on magento.com tests for.
I don't know how reliable the templates-master tool is, but to be absolutely sure that the patches have been installed, please refer to: How to check if Magento patch has been installed?
Please check if you have copies in
app/code/local of any of the files listed in
etc/applied.patches.list which would render the patch useless. Class rewrites could also be a problem, if they copy lots of code from the original class.