user guide

Security scans

The Security page of each site runs a broad health check and turns the results into a score and a prioritized to-do list. It has three tabs: Overview, Security scan and Malware (malware has its own guide).

Running a scan

Click Run scan. The dashboard collects fresh facts from the site and from independent sources, evaluates them, and updates the page when done. A manual scan also triggers a malware scan right after it, so both results stay in step.

What the scan covers

  • Known vulnerabilities: your installed plugin, theme and core versions are matched against a professionally maintained vulnerability database (the Wordfence Intelligence feed). Each finding links to the advisory and recommends the closest fixed version.
  • Weak passwords: the connector checks the site’s accounts against common-password lists, on the site itself. Passwords never leave the site; the dashboard only learns “weak” or “fine”.
  • Users and roles: risky accounts, for example administrators that look forgotten or a username like “admin”.
  • Plugins: abandoned or removed plugins that no longer receive fixes.
  • Core: whether WordPress itself is current.
  • Configuration: settings that weaken the site, such as file editing enabled in wp-admin or debug output in production.
  • SSL certificate: expiry, trust chain and hostname match, checked from the outside so it works even when the site is down.
  • Malware: the latest malware scan result is folded into the score.

The score and the findings

The score runs 0 to 100 and drops with each finding by severity (critical findings cost by far the most). The Security scan tab lists every finding with its severity (low, medium, high, critical); filter by severity and expand a finding for the details and a practical How to fix it block. Many fixes are one click away in the dashboard itself, for example updating the vulnerable plugin.

Automatic scans

In the security settings you can enable automatic scans so the check runs on a schedule without you thinking about it; security and malware scans can be toggled independently. Automatic scanning is part of the Premium site plan; manual scans are free on every plan. See Site plans and billing.

Vulnerability data

Vulnerability intelligence is provided by the Wordfence Intelligence feed (copyright Defiant Inc.); each finding links to the original advisory. The database is mirrored daily, so newly published vulnerabilities show up in your next scan.