How is the GuardPress security score calculated?

The score starts at 100 and subtracts fixed point deductions. Feature deductions (subtracted if the module is disabled): Malware Scanner -15, Brute-Force -10, Two-Factor Authentication -10, Firewall -10, File Monitor -10, Login CAPTCHA -5, Spam Protection -5, Security Headers -5, XML-RPC Disabled -5, Force Strong Passwords -5. Activity deductions: -5 per malware threat detected in the last 7 days (capped at -20), and -10 if more than 5 plugins need updates. Score is capped at zero. Grade thresholds: A at 90+, B at 80+, C at 70+, D at 60+, F below 60.

Why isn't my score 100 after Quick Start?

Quick Start enables the highest-weight modules (Firewall, Brute-Force, Malware Scanner, 2FA) but leaves smaller hardening toggles off. Common reasons to stop short of 100: Login CAPTCHA off (-5), Security Headers not enabled (-5), Force Strong Passwords off (-5), or a growing backlog of plugin updates (-10 once you're above 5 pending). The score's not a value judgment; it's a checklist. Whatever it flags is the thing to fix next.

What does the Active Threats stat box tell me?

It counts unresolved malware findings from the scanner. The stat box changes color based on state: green when there are none, amber for low-severity findings that need review, red when critical findings are unacknowledged. Zero should be the resting state on a clean site. When it's non-zero, click through to the Malware Scanner page to Quarantine, Delete, or Ignore each finding.

The dashboard shows blocked requests but I can't tell if any were legitimate. How do I check?

Click through from the Recent Security Alerts feed to the full activity log. Each blocked request shows the source IP, User-Agent, requested path, the specific rule that fired, and the reverse DNS. Legitimate blocks look like exploit payloads (?d+allow_url_include+auto_prepend_file, /wp-config.php.bak, credential harvest paths, etc). False positives look like normal admin traffic getting flagged by a rule that's too aggressive. The Firewall False Positives guide covers common shapes.

What are the four stat boxes on the dashboard?

Security Score (the 0-100 number and letter grade), Failed Logins (count of recent failed sign-in attempts), Blocked IPs (how many IPs are currently on the block list), and Active Threats (unresolved malware findings from the scanner). Below the stat boxes are the Recent Security Alerts feed and a Quick Actions panel for common tasks.

Understanding the GuardPress Security Dashboard and Security Score

Open GuardPress → Dashboard and you see one big security score, four stat boxes, a Recent Security Alerts feed, and a Quick Actions panel. This article decomposes all of it: how the score is actually calculated, what each stat box is counting, what to change to raise a score that isn’t 100, and the letter-grade thresholds.

How the security score is actually calculated

The score starts at 100 and subtracts fixed point deductions for each disabled module and each open security issue. Full breakdown, straight from the source:

Feature deductions (subtracted if the module is disabled)

Feature	Deduction if disabled
Malware Scanner	−15
Brute-Force Protection	−10
Two-Factor Authentication	−10
Firewall	−10
File Monitor	−10
Login CAPTCHA	−5
Spam Protection	−5
Security Headers	−5
XML-RPC Disabled	−5
Force Strong Passwords	−5

Activity-based deductions

Condition	Deduction
Recent malware threats (detected in the last 7 days)	−5 per threat, capped at −20 total
More than 5 plugins need updates	−10 (flat)

Letter grade thresholds

The dashboard also shows a letter grade derived from the score:

Score	Grade
90–100	A
80–89	B
70–79	C
60–69	D
Below 60	F

The score is capped at zero on the low end, so a site with everything disabled and multiple active malware findings can’t go negative. Malware Scanner carries the single heaviest weight (−15) because a malware compromise is the highest-cost security failure; everything else is a step above the danger line.

Every element on the dashboard, explained

The dashboard has four stat boxes across the top, a Recent Security Alerts feed, and a Quick Actions panel. Here’s what each one shows.

The four stat boxes

Stat box	What it counts
Security Score	The 0–100 number and its letter grade (A/B/C/D/F), calculated from the algorithm above. Click through to see the specific factors dragging your score down.
Failed Logins	Count of failed sign-in attempts your site has seen recently. A gradually-rising number means credential-stuffing scanners have found you; a sudden spike means you’re in an active brute-force wave. Cross-reference with the IP Management page for the offending IPs.
Blocked IPs	How many IPs are currently on the block list (auto-lockouts from brute-force plus your manual Blacklist entries). Click through to the IP Management page for the full three-list view (Whitelist, Blacklist, Active Lockouts).
Active Threats	Unresolved malware findings from the scanner. The box changes color based on state: green when there are none, amber for low-severity findings that need review, red when critical findings are unacknowledged. Zero should be the resting state on a clean site.

Recent Security Alerts

Feed of recent security events (firewall blocks, lockouts, malware findings, integrity changes) with timestamp and source. Read this weekly to understand what your site is being attacked with. If the mix skews heavily toward one attack shape (SQL injection attempts, PHP-CGI RCE probes, credential stuffing), that’s the class of attacker currently interested in your site — see Spotting Spoofed AI Crawler Attacks for how to read a critical-threat alert.

Quick Actions

Panel of one-click shortcuts to the most-used tasks: run a malware scan, view the IP Management page, open the settings screen for the module you most recently changed. This is the fastest path from “I noticed something on the dashboard” to “I’m looking at the relevant settings page.”

Why your score isn’t 100 (and what to fix)

The score deducts points for disabled modules and open security issues. Every deduction maps to a specific fix. Common items and their remedies, in order of point value:

Malware Scanner is disabled (−15)

The largest single deduction. Enable in GuardPress → Settings under the Malware Scanner section. On Quick Start this should already be on; if it’s off, something disabled it deliberately (usually during a debugging session) and you can flip it back on with no re-baseline needed.

Active malware threats detected (−5 per threat, capped −20)

Recent scans found suspicious files that haven’t been resolved. Open GuardPress → Malware Scanner, review each detection, and either Quarantine, Delete, or Ignore (whitelist as a false positive). Deduction clears once the threat is resolved.

Brute-Force Protection is disabled (−10)

Rarely off unless deliberately disabled. Enable in Settings. Tune the lockout threshold and duration on the same page if the defaults (5 attempts / 15 minutes) aren’t right for your traffic.

Two-Factor Authentication is disabled (−10)

See Setting Up Two-Factor Authentication for the safe enable order (authenticator app first, backup codes stored off-device, test the flow).

Firewall is disabled (−10)

Enable in GuardPress → Firewall. If you turned it off to debug a false positive, see Firewall False Positives for how to whitelist the specific pattern instead of disabling the whole firewall.

File Monitor is disabled (−10)

Enable in Settings. The initial baseline is established on next scheduled scan, so the first hour after enabling shows “Baseline in progress” before real drift alerts start firing.

More than 5 plugins need updates (−10)

The threshold is generous by design (small backlogs don’t deduct). Once you’re above 5, update everything at once from Dashboard → Updates. Take a backup first with SiteVault or your host’s snapshot.

Login CAPTCHA / Spam Protection / Security Headers / XML-RPC / Force Strong Passwords disabled (−5 each)

The smaller hardening toggles. Each individually is minor; enabling all of them recovers 25 points. Turn on in Settings. Security Headers in particular can require per-site tuning — start with the report-only variant if your theme has inline scripts that a strict CSP would break.

The score is a checklist, not a threat model

A high GuardPress score means the plugin’s configuration is complete and healthy. It does not mean your site is unattackable. Two things the score cannot see:

Application-level vulnerabilities in your custom code. If your theme or a custom plugin has a SQL injection bug in one of its endpoints, GuardPress’s firewall catches most known-shape payloads but can’t audit your source code.
Host-level compromises. If your hosting account itself gets breached (SSH key theft, control panel password reuse), an attacker can bypass everything above the PHP layer.

Treat 100 as “GuardPress can’t find anything more to configure” and treat security overall as an ongoing operational discipline. See The Pre-Launch WordPress Security Checklist for the manual review items GuardPress can’t automate.