When I started building WP Triage, I already knew what a noisy WordPress portfolio felt like. Years of client sites, plugins, and later WP Foundry had the same failure mode: plenty of signals, not enough clarity on what to do next. The product brief was deliberate — not another scanner dump, a decision engine.
Here is how the scoring model took shape, and why the output is always a score plus a short fix order rather than a long list.
Start at 100, subtract what matters
Each site begins at a clean score of 100. Issues deduct weight until the floor of 0. That keeps the number intuitive: higher is safer, and a sudden drop is something you can alert on without paging for every medium CVE.
Weights favour real exposure. An active remote code execution dominates a single medium CVE. End-of-life PHP outranks slow-burn maintenance debt. Unmaintained plugins matter, but they sit below known exploits. The full matrix lives on the scoring methodology page — including a worked example — so agencies can see why a site moved.
Exploitability before tidy-up work
Early prototypes treated every finding as roughly equal. That failed the moment a brochure site with an abandoned widget outranked a WooCommerce store with a known RCE. We biased the engine toward exploit status (including KEV-style signals), severity, and whether a component is active on the site. Inactive plugins still count — at a reduced multiplier — because they can be re-enabled or probed, but they should not drown out live attack surface.
Top three is the product
The ranked inventory on site detail is useful for tickets and client notes. Digests, emails, and the portfolio list only surface the top three issues. That constraint came from how I actually worked across many installs: if the next actions are not short enough to finish in a session, the list gets ignored.
What we leave out on purpose
WP Triage does not replace firewalls, backups, or remote management. Scoring answers a narrower question: across the sites you already manage, which ones need attention now and in what order. Keeping that scope honest is what keeps the triage list usable.
Read the full scoring methodology, or start with what WordPress risk scoring means in practice.