A transparent look at how WP Triage prioritizes risk and recommends what to fix first.
How scoring works
Every connected site starts at 100. We apply weighted deductions based on vulnerability severity, exploitability signals, software lifecycle risk, and maintenance posture. The final score is capped between 0 and 100 and mapped to a clear band: Safe, At Risk, or Critical.
Scores exist to sort work. Two sites can both have “issues”; the score and top-three ranking tell you which site and which fixes consume the next maintenance block. For the product framing behind this model, see WordPress risk scoring.
Inputs we evaluate
- Known vulnerabilities in installed plugins/themes and their severity
- Exploitability signals (for example known exploited vulnerabilities)
- Runtime risk (for example end-of-life PHP versions)
- Maintenance drift (for example unmaintained or closed components)
- WordPress core patch lag relative to the current release line
What the score outputs
- A single score from 0 to 100 for portfolio sorting
- A risk band (Safe, At Risk, Critical)
- A ranked top-three issue list and recommended fix order
- A full ranked issue inventory on the site detail page
How issue ranking works
Inside a site, issues are ordered by estimated impact on exposure — not by alphabetical plugin name or “newest CVE.” In practice that means:
- Actively exploitable or critical vulnerabilities rise above low-severity noise
- Lifecycle risks (EOL PHP, abandoned plugins) compete with CVEs when they materially widen blast radius
- Inactive or low-exposure components can be weighted down so they do not crowd out active threats
The top three issues are the ones that appear in digests and emails. Everything else remains available on the site detail page so you can still dig in without drowning the default view.
Example: why this site scored 62
This example follows the current default risk-engine weights shown in product configuration:
- Base score: 100
- PHP branch past active support: -20
- Inactive low-severity plugin vulnerability with KEV signal: -9 (3 base + 15 KEV, then inactive multiplier 0.5)
- WordPress core patch behind latest: -5
- One unmaintained plugin (>24 months): -4
- Total deduction: -38
- Final score: 62 (At Risk)
Recommended fix order for this example
- Upgrade PHP to a supported version
- Patch or remove the vulnerable plugin component
- Update WordPress core, then clean up unmaintained components
After those changes land and the next snapshot runs, the score should rise and the top-three list should reshuffle — that feedback loop is how teams verify triage work actually reduced exposure.
What scores do not mean
- A score is not a guarantee the site is clean or compromised
- A Safe band does not mean “ignore forever” — new CVEs can move a site overnight
- Suppressions change what counts toward the score; use them for accepted risk, not to hide work you still intend to do
Why this matters for agencies
Most tools produce large alert lists. WP Triage is built to answer a narrower question: what should we fix first across the portfolio today? That is why the score and fix order are designed to be explicit and explainable. Agencies often pair this with a Monday triage pass — see the agency workflow.
Get started
Risk scoring overview