What to do when your security score is low

Q. My security score is low — do I need to address every item?

A. You don't need to achieve a perfect 100 on every item. Focus on the highest-risk items first.

Prioritization Guidelines

Each item in the security score has an assigned risk level. We recommend addressing them in the following order of priority.

Critical (Address Immediately)

• Update WordPress core — Older versions contain known vulnerabilities
• Disable debug mode — Set WP_DEBUG to false in wp-config.php
• Strengthen admin passwords — Changing the "admin" username is also recommended

High Priority (Within 1 Week)

• Update plugins and themes — Outdated plugins are a common attack vector
• Enable brute force protection — Configure login attempt limits
• Remove unused plugins — Simply deactivating them still leaves vulnerabilities exposed

Medium Priority (Within 1 Month)

• Configure HTTP security headers
• Restrict unnecessary REST API endpoints
• Review file permissions

Low Priority (Plan and Address)

• Change the database table prefix
• Remove information disclosure files (readme.html, etc.)

Target Scores

Not every site needs to aim for 100. Set a goal appropriate for your site type.