Security Health

Last updated: 9th July 2026 for CC Security Essentials version 1.0

Introduction

Security Health reviews your website’s current security configuration and highlights areas that may benefit from attention.

Rather than simply displaying whether a feature is enabled or disabled, Security Health helps you understand the overall security posture of your website and identifies practical improvements where appropriate.

The goal isn’t to achieve a perfect score or enable every available protection. Instead, Security Health provides guidance that helps you decide which recommendations are suitable for your website.

Why Security Health Matters

Every WordPress website is different.

A personal blog, an online shop, a membership website and a company website all have different requirements.

For that reason, there is rarely a single “correct” security configuration.

Security Health helps by:

  • reviewing your current configuration
  • identifying potential improvements
  • explaining why recommendations are made
  • directing you to the appropriate settings
  • helping you build a well-balanced security configuration over time

Think of Security Health as a regular check-up for your website rather than a pass-or-fail security test.

Understanding Recommendations

Recommendations are intended to be helpful rather than alarming.

Each recommendation is based on your website’s current configuration and highlights an area where security may be improved.

For every recommendation, CC Security Essentials aims to answer three questions:

  • What is the recommendation?
  • Why is it being suggested?
  • Where can I change the setting?

This makes it easier to understand the purpose of a recommendation before deciding whether to apply it.

Understanding Status Indicators

Security Health uses clear visual indicators to help you understand the status of each recommendation.

Depending on the feature, you may see that a protection is:

  • Enabled
  • Disabled
  • Recommended
  • Verified (where supported)

These indicators are designed to provide useful information at a glance without requiring detailed technical knowledge.

Not Every Recommendation Applies to Every Website

One of the guiding principles of CC Security Essentials is that recommendations should be practical.

For example:

A business brochure website may have no need for visitor comments, making it sensible to disable them.

By contrast, a news website or community website may rely heavily on comments, in which case disabling them would not be appropriate.

Similarly, some websites make extensive use of the REST API for mobile apps or third-party integrations, while others never expose it to unauthenticated visitors.

Security Health highlights possibilities rather than enforcing a particular configuration.

Using Security Health Effectively

A good approach is to review one recommendation at a time.

For each recommendation:

  1. Read the explanation.
  2. Decide whether it applies to your website.
  3. Make any necessary changes.
  4. Verify that the protection is working, where verification is available.
  5. Return to Security Health to review the next recommendation.

Making gradual, well-understood improvements is usually preferable to enabling multiple security features all at once.

Relationship with the Security Guide

Security Health and the Security Guide are designed to complement one another.

Security Health identifies areas that may deserve attention.

The Security Guide explains those recommendations in greater detail, helping you understand the benefits, considerations and appropriate use cases before making changes.

If you’re unsure about a recommendation, the Security Guide is the best place to learn more.

Verification

Where verification is supported, Security Health may indicate whether a protection has been successfully confirmed.

Verification provides greater confidence than simply checking that a setting has been enabled.

For example, after enabling XML-RPC protection, the plugin can verify that your website is actually rejecting XML-RPC requests rather than assuming the setting has taken effect.

Not every protection can be verified automatically, but where verification is possible, it forms an important part of the review process.

Reviewing Security Health

Your website changes over time.

You may:

  • install new plugins
  • change themes
  • introduce new functionality
  • add users
  • change hosting providers
  • update WordPress

Any of these changes may affect your website’s security configuration.

We recommend reviewing Security Health periodically, particularly after significant changes or updates.

Frequently Asked Questions

Does every recommendation need to be followed?

No.

Recommendations are intended to help you make informed decisions.

Some recommendations may not be appropriate for the way your website operates.

Why does a recommendation still appear after I’ve decided not to follow it?

Security Health reflects your current configuration.

If you’ve deliberately chosen not to enable a recommended feature because it doesn’t suit your website, the recommendation may continue to appear as a reminder rather than an indication that something is wrong.

Can Security Health detect every security issue?

No.

Security Health focuses on the protections and configuration managed by CC Security Essentials.

Website security also depends on factors such as:

  • keeping WordPress up to date
  • using reputable plugins and themes
  • strong passwords
  • secure hosting
  • regular backups

Security Health should be viewed as one important part of an overall security strategy.

Is Security Health continuously monitoring my website?

Security Health reflects your website’s current configuration when viewed.

It is intended as a review tool that helps you understand and improve your website’s security rather than a real-time intrusion detection system.

Best Practice

When reviewing Security Health, we recommend the following workflow:

  1. Open Security Health.
  2. Review the current recommendations.
  3. Read the related article in the Security Guide if you need more information.
  4. Configure the feature if appropriate.
  5. Use Verification to confirm the protection is working.
  6. Return to Security Health and continue with the next recommendation.

Following this process helps ensure that each change is understood and verified before moving on.

Related Articles

Continue with: