Implement Security Recommendations

A security scan is most useful when you turn its findings into actionable fixes. Siteligent helps you review vulnerabilities, understand their severity, and work through them in order of priority.

Not every finding needs the same response. Start with vulnerabilities that present the greatest risk, then work through lower-priority findings once the critical issues have been addressed.

1. Address Critical and High-Severity Findings First

Critical and High severity vulnerabilities should be your first priority. For example, a critical vulnerability involving SQL injection or remote code execution can potentially allow an attacker to compromise the website or server.

Siteligent clearly identifies these findings in the security dashboard so you can focus on them first. Don't leave a critical or high-severity vulnerability unresolved simply because the website appears to be working normally. A vulnerability can exist without producing any visible symptoms.

2. Focus on WordPress Core and Active Plugins

Next, pay particular attention to vulnerabilities affecting:

These components are actively loaded by your website and can therefore represent an important part of your site's attack surface.

If a security finding affects an active plugin, check whether the developer has released a patched version and update it as soon as practical.

Inactive plugins and themes should not simply be ignored. Although they aren't currently active, their files still remain on your server. Vulnerable files can increase the overall attack surface of your website.

If an inactive plugin or theme is no longer required, the safest approach is generally to remove it completely rather than leaving it installed indefinitely.

Most plugin and theme vulnerabilities are fixed by the developer in a newer release.

When Siteligent reports a vulnerability, check the Patched Version shown in the Security Findings panel.

Update a Vulnerable Plugin or Theme

The follow-up scan confirms whether the vulnerability is no longer being reported.

A security update should ideally fix the vulnerability without introducing a new website problem.

When updating a plugin or theme, you can use Safe Updates where available to help verify that the website still renders correctly after the update.

This is particularly useful for production websites where you want to reduce the risk of an update causing a visible issue.

Sometimes a vulnerable plugin doesn't have a patched version because its developer has stopped maintaining it. In this situation, simply waiting for an update may not be an option.

Recommended Approach

Removing the vulnerable plugin is important because deactivation alone doesn't remove its files from the server.

Security findings can also affect your server's PHP version. If Siteligent reports serious vulnerabilities in your PHP environment, review the specific CVEs identified by the security analysis.

PHP is managed at the server or hosting level, so changing it generally isn't something you do from the WordPress plugin manager.

The source specifically gives PHP 8.1 or PHP 8.2 as examples of supported branches. The appropriate version for your site depends on your hosting environment and the compatibility of your WordPress installation, plugins, and themes.

After addressing a vulnerability, don't assume the finding has been resolved.

Run a fresh Security Scan and review the results. A successful follow-up should show that the affected vulnerability has been removed or otherwise resolved.

For sites with multiple findings, work through them in this order:

The exact order can vary depending on the specific vulnerability and your site's configuration, but Critical and High findings should generally receive immediate attention.

After making the required changes, run another security scan to confirm that your site's security posture has improved.