Security Score: What it is and how it is calculated

This article explains how the WP Umbrella security score is calculated and how to read it. It covers each pillar of the score (known vulnerabilities, malware, hardening and access, site health, Site Protect and the activity log), the cap applied when malware is confirmed, how dismissed alerts are treated, and the A to F grade shown across the dashboard.

The Security Score estimates how well a WordPress site is protected against known security risks, on a scale from 0 to 100.

The score adds up two parts:

• Security hygiene (85 points): what every site can achieve on its own, by fixing vulnerabilities, keeping malware scans clean, hardening WordPress and keeping the site healthy.

• Active protection (15 points): the Site Protect firewall and the activity log, provided by the security add-on.

A well-maintained site without the add-on can reach 85 (grade B). Grade A (90 and above) requires active protection.

The score now takes confirmed malware into account. A high score is still not a guarantee: it reflects what WP Umbrella can detect today, not every possible risk.

Score composition (100 points)

The score is the sum of six pillars. Four of them (85 points) are available to every site, the last two (15 points) require the security add-on.

On top of the pillars, confirmed malware caps the total score at 20 (see Score cap below).

1. Known vulnerabilities (30 points)

Known vulnerabilities are publicly documented security issues in plugins, themes or WordPress core. They are actively targeted by automated attacks and remain the main entry point for WordPress compromises.

Each vulnerability removes points from this pillar:

The pillar cannot go below 0, so vulnerabilities cost at most 30 points.

With Site Protect enabled, vulnerabilities still count, but only 30% of their penalty is applied. For example, one high vulnerability costs 15 points without Site Protect and 4.5 points with it. Virtual patching reduces the risk; it does not replace updating.

2. Malware (20 points)

Malware means the site may already be compromised, so it weighs directly on the score.

3. Hardening and access (15 points)

Hardening options and admin access controls limit what an attacker can do, even when another weakness exists.

• Hardening options: up to 11 points, in proportion to the hardening options enabled among those available to the site. IP blocking is only available with the security add-on, so it is not counted for sites without it.

• Two-factor authentication enforced for administrators: +4 points.

• Hidden administrator account detected: the whole pillar drops to 0. A hidden admin account is a common sign of compromise.

4. Site health (20 points)

Outdated software and misconfigurations weaken the security baseline of a site. Unsupported PHP or WordPress versions no longer receive security fixes, and other settings can amplify the impact of a vulnerability.

5. Site Protect firewall (10 points, security add-on)

Site Protect blocks known exploit attempts at the server level using Patchstack virtual patching. It protects the site before updates are applied.

Site Protect also reduces the vulnerability penalty to 30% (see pillar 1).

6. Activity log (5 points, security add-on)

The activity log records what happens on the site and flags unusual behavior, so suspicious activity can be spotted and handled quickly.

• Activity log enabled: 5 points.

• A critical anomaly is open: -3 points.

• Otherwise, each open alert: -1 point, up to -2.

Score cap

When malware is confirmed, the total score cannot exceed 20, whatever the other pillars add up to. A good score elsewhere should not hide an infected site.

Dismissed alerts

Dismissing an alert marks it as an accepted risk. Some choices are legitimate (WP_DEBUG on a staging site, a plugin kept inactive on purpose), so dismissing them restores the points. Others still carry part of their risk.

Final score calculation (per site)

Hygiene           = vulnerabilities (30) + malware (20) + hardening and access (15) + site health (20)
Active protection = Site Protect (10) + activity log (5)
Cap               = 20 if malware is confirmed, otherwise 100

Security score    = min(hygiene + active protection, cap)

Grades

The same A to F scale is used everywhere in the dashboard: site list, security page and site overview.

Examples

Unless stated otherwise, everything else on the site is in good shape: Site Protect and activity log enabled, hardening complete, recent malware scan.

Global score

The global score is the average of all site scores in your dashboard.