Understanding your site security status
Your Security Dashboard continuously monitors your WordPress site for vulnerabilities and displays an overall security status so you always know where your site's security health. This article explains what vulnerabilities are, how your status is calculated, and what to do when issues are found.
What is a vulnerability?
A vulnerability is a weakness in software, such as a plugin, theme, or WordPress core, that attackers can exploit to gain unauthorized access to your site, steal data, inject malicious content, or take your site offline.
Vulnerabilities are not the same as malware. A vulnerability is an open door; malware is what walks through it. Fixing vulnerabilities before attackers find them is one of the most effective ways to keep your site safe.
Why WordPress sites are frequently targeted
WordPress powers over 40% of all websites on the internet, making it a high-value target for automated attacks. Most attacks aren't personal; bots continuously scan the web looking for sites running outdated or known-vulnerable software.
The most common sources of vulnerabilities in WordPress environments are:
- Plugins: The primary source of WordPress vulnerabilities, accounting for 90-96% of vulnerabilities. Plugins are third-party code that extends your site's functionality. Because thousands of developers maintain millions of plugins, quality and update frequency vary widely. An outdated or abandoned plugin can become an easy entry point.
- Themes: Like plugins, themes can contain insecure code. Even inactive themes installed on your site can be exploited.
- WordPress Core: The core WordPress software is actively maintained, but sites that aren't updated promptly after a new release remain exposed to known issues.
- PHP Version: Running an outdated PHP version can expose your site to server-level vulnerabilities, even if WordPress itself is up to date.
Vulnerability priority levels
Not all vulnerabilities carry the same risk. Each detected issue is assigned a severity level based on how easily it can be exploited and the potential damage it could cause.
High priority
These are serious vulnerabilities that attackers actively exploit. They could allow an attacker to take over your site, access customer data, install malware, or redirect your visitors. Immediate action is strongly recommended.
Common examples:
- Remote code execution (attacker can run code on your server)
- SQL injection (attacker can read or manipulate your database)
- Unauthenticated privilege escalation (attacker gains admin access without logging in)
Medium priority
These vulnerabilities pose a real risk but typically require specific conditions, such as an authenticated user or a particular configuration, to be exploited. They should be addressed promptly to prevent escalation.
Common examples:
- Cross-site scripting (XSS) that requires a logged-in user
- Authenticated file upload issues
- Information disclosure that could aid further attacks
Low priority
These are minor weaknesses that are not readily exploitable or have limited impact on their own. They are worth addressing as part of good security hygiene, but are unlikely to result in a site compromise on their own.
Common examples:
- Version disclosure (exposing software version numbers)
- Missing optional security headers
- Low-impact configuration issues
How your security status is calculated
Your overall status reflects the highest severity vulnerability currently detected on your site. It updates automatically after every scan.
| Status | What it means | Conditions |
|---|---|---|
| Critical | Your site needs immediate attention | 1 or more high priority vulnerabilities detected |
| At Risk | Room for improvement | No high priority issues, but 1 or more medium priority vulnerabilities detected |
| All Clear | Looking good | No high or medium priority vulnerabilities detected |
What to do based on your status
If your status is Critical:
- Select View Issues to see a complete list of detected vulnerabilities.
- Identify which plugins, themes, or core files are affected.
- Sign in to WordPress, select Updates, and then update the affected software immediately.
- If an update isn't available for an affected plugin, consider deactivating and removing it until a patch is released.
If your status is At Risk:
- Select View Issues to review medium-priority vulnerabilities.
- Update affected plugins, themes, or WordPress core.
- Prioritize issues that are easier to exploit.
If your status is All Clear:
Your site's security features are active, and no significant vulnerabilities have been detected. Keep your site in this state by:
- Removing plugins or themes you no longer use.
- Check your site security status regularly.
Frequently asked questions
How often does my site get scanned? Scans run automatically on a regular schedule. Your first scan may take up to 36 hours to complete. After that, your status will refresh after each completed scan.
A vulnerability was detected, but I already updated the plugin. Why is it still showing? The status will update after the next completed scan cycle.
Can I have vulnerabilities even if my site looks fine? Yes. Many vulnerabilities don't visibly affect your site until they're actively exploited. A site can appear completely normal while being compromised in the background. Regular scanning catches these issues before they become serious problems.
What's the difference between a vulnerability scan and malware scanning? A vulnerability scan checks your installed software versions against known vulnerability databases to identify weaknesses before they're exploited. Malware scanning checks your site files and database for signs of an existing infection or compromise. Both are complementary; vulnerability scanning is prevention, and malware scanning is detection.
Why can't I just ignore low-priority vulnerabilities? Low-priority vulnerabilities on their own rarely lead to a compromise, but they can be combined with other weaknesses in "chained" attacks. Addressing them over time is good security hygiene.