Understanding the Security tab
The Security tab is built around one idea: every number and badge should be explainable in one sentence. Here's what each part actually checks.
Understanding your Security Score
The score is a simple percentage: (number of hardening checks currently enabled) ÷ (total checks) × 100. There's no hidden weighting — HTTPS counts the same as hiding your WordPress version. If you want the score higher, the checklist directly under it tells you exactly which box is unchecked.
The SSL Checker
This opens a real, temporary connection to your own domain on port 443 and reads the certificate your server presents — the same thing a browser's padlock icon reflects. It reports the issuer, expiry date, and days remaining, cached for 24 hours. It cannot fix an expiring certificate for you; renewal happens through whoever issued it (often your host, automatically, if you're on Let's Encrypt).
Disabling PHP execution in uploads
This applies a small, separate .htaccess file directly inside wp-content/uploads/ that blocks any .php, .phtml, or .phar file there from executing. It's a standard defense: your uploads folder should only ever contain media, so if a malicious file ever ended up there, this stops it from running. It has no effect on anything outside that folder.
What this doesn't do
Being direct about the boundaries: this is not a malware scanner. It doesn't compare your files against WordPress.org's checksums to detect tampering, and it doesn't monitor for brute-force login attempts in real time. It also never modifies wp-config.php or your file permissions automatically — the Security tab gives you specific, read-only recommendations for both instead, since an automated mistake there can take a site down with no easy recovery.