When an application user is assigned a specific site, they can typically only see that site when selecting site assignments for other records that they add or edit. However, in the Web functional area, when setting up how web transactions will be downloaded into batches, users can see all sites instead of just the specific site that's been assigned to them.
If the user only has one role that is secured by site, then they will only be able to see that site in the Web area. However, if the user has additional roles that are not site-secured, even if they are unrelated to the Web area, that area will not be site-secured.
Download and install the latest version and patch, if applicable.