Siteligent's security scanner checks your WordPress site for known security vulnerabilities across WordPress core, plugins, themes, and your PHP environment. The scanner is designed to provide fast results while using vulnerability intelligence from established security databases.
How Siteligent's Security Scanner Works
Siteligent uses a local vulnerability database to perform most security checks instead of making an external API request for every item being scanned.
Pre-Synced Vulnerability Intelligence
Siteligent periodically synchronizes a local copy of the Wordfence Intelligence vulnerability feed.
The vulnerability data is refreshed every 6 hours, allowing Siteligent to perform scans against an up-to-date local dataset.
Fast Local Scanning
When you start a security scan, Siteligent checks your site's installed software, plugins against the local vulnerability database.
Because the primary scan uses the local database, it doesn't need to make an external network request for every plugin or theme. This makes the scanning process fast and avoids unnecessary API latency or rate-limit problems.
Additional Vulnerability Coverage
If a specific plugin or theme isn't available in the Wordfence Intelligence feed, Siteligent also use the WPVulnerability API to check for additional vulnerability information.
Siteligent also uses WPVulnerability data to cross-reference your PHP version for serious security issues.
What Does Siteligent Scan?
The security scanner checks the software and environment that make up your WordPress installation.
WordPress Core: Siteligent checks your installed WordPress version against known vulnerabilities. If the version you're running is affected by a known CVE, it will be reported as a security finding.
Plugins and Themes: Siteligent checks all installed plugins and themes, including both active and inactive items. It compares their slugs and installed versions against known vulnerability information and CVEs. This means an inactive plugin isn't automatically ignored just because it isn't currently active.
PHP Version: Your site's active PHP version is also checked for known security issues. If the PHP version has known severe vulnerabilities, Siteligent can report those findings so you can determine whether the server environment needs to be updated.
Why Database Vulnerabilities aren't included
Siteligent intentionally does not include MySQL or MariaDB vulnerabilities in the site's security report. Database software is normally managed at the hosting or server level rather than through WordPress.
Including database-engine CVEs in the same report could produce a large number of findings that you may not have the ability to resolve from Siteligent, creating unnecessary noise and false-positive-style alerts.
For that reason, Siteligent focuses its security scan on the WordPress software and PHP environment that you can directly investigate and maintain through your website or hosting configuration.
Automatic Security Scans
Siteligent runs security audits automatically in the background. A nightly automated scan checks your connected websites once per day and records the results.
If critical security findings are detected, Siteligent can also send notifications based on your configured notification preferences. This means you don't need to manually run a security scan every day to keep track of newly discovered vulnerabilities.
Run a Security Scan Manually
You can also run a scan whenever you want. A manual scan is particularly useful after making changes to your site's software stack.
To run one:
Open the website in Siteligent.
Go to the Security tab.
Click Scan Now.
Wait for the scan to complete.
Review the findings and severity levels.
Running a scan after updating plugins, changing themes, or making other significant changes can help confirm the current security state of the site.
Understand Your Security Score
After a scan completes, Siteligent gives your website an overall Security Score from 0 to 100.
A higher score indicates a healthier security state, while a lower score means the scan has identified more significant security concerns.
Siteligent also assigns a letter Grade from A to F to make the result easier to understand at a glance.
Grade A - 90 to 100: An A indicates clean or excellent security health. There may be minor low-severity notices, or there may be no significant findings at all.
Grade B or C - 70 to 89: B or C indicates that the site has moderate security issues. This can include available plugin updates or medium-severity vulnerabilities in installed themes or plugins.
Grade D or F - Below 70: D or F indicates more serious security problems. Critical or high-severity vulnerabilities may be present in WordPress core, active plugins, or themes and should be investigated as soon as possible.
Understand Vulnerability Severity
Not every security finding has the same level of risk. Siteligent groups vulnerabilities into four severity levels based on their CVSS (Common Vulnerability Scoring System) rating.
Critical: Critical vulnerabilities represent the highest level of risk. They may be relatively easy to exploit and can potentially result in serious consequences such as remote code execution (RCE) or complete website compromise. These findings should be treated as an immediate priority.
High: High severity vulnerabilities can also pose significant risk. Examples include vulnerabilities involving:
SQL injection
Unauthorized administrative access
Other vulnerabilities that can give an attacker significant control or access
These should be addressed promptly.
Medium: Medium severity vulnerabilities represent a more moderate risk. Examples can include:
Cross-site scripting (XSS)
Cross-site request forgery (CSRF)
Other vulnerabilities affecting standard utility functionality
These should still be reviewed and resolved, particularly when a patch is available.
Low: Low severity findings generally have a lower immediate security impact. Examples include:
Sensitive path disclosure
Minor information leaks
Other lower-risk security issues
Although these are less urgent, keeping your site's software updated can help eliminate them over time.
What to Do After a Scan
After reviewing your scan:
Start with Critical and High severity findings.
Check whether a patched version is available.
Review vulnerabilities affecting WordPress core and active plugins first.
Investigate inactive plugins and themes as well.
Update vulnerable software where an official fix is available.
Remove software that is no longer maintained or required.
Run another Security Scan after making the changes.
The goal isn't simply to achieve a higher score, it is to identify real security issues and systematically reduce the site's exposure.