Keeping sites healthy
Security scanning
Vulnerable versions, malware patterns and weak headers, checked continuously.
The Security tab reports on three separate things, and it helps to keep them apart.
Known vulnerabilities
Installed plugin and theme versions are compared against public vulnerability data. A match tells you the version you are running has a published issue and which version fixes it. This is the highest-signal part of the page: it is fact, not heuristic.
Sites can be set to auto-update only vulnerable components, which closes the window without opting into every release. See Updates.
File and configuration checks
Patterns associated with compromise, obviously wrong file permissions, and configuration that is riskier than it needs to be — file editing enabled in wp-admin, directory listing left on, debug output exposed publicly.
These are indicators, not verdicts. A flagged file is worth looking at; it is not proof of a compromise.
Response headers
Whether the site sends the headers a modern site should: transport security, content-type options, frame options, referrer policy. Missing ones are listed with what to set.
What to do with a finding
Vulnerable version — update it, and if you cannot, note why. Suspicious file — look at it before deleting anything. Missing header — usually a server or plugin setting rather than something MegaManager changes for you.
Something missing or wrong here? Tell us.