One number, from things that break
The health score is a number from 0 to 100 per site, recalculated after every check and after every change. It is built from the checks that predict a real problem, weighted by how much they matter.
| Check | Effect |
|---|---|
| Core file integrity | A changed core file is the largest single deduction. It is how most compromises show up. |
| Unknown administrator | An administrator account nobody on the team created: large deduction until reviewed. |
| Known vulnerability in an installed version | Deduction per plugin, larger when a fix is available and not applied. |
| Versions behind | WordPress, PHP, theme and plugins: small deductions that add up. PHP near end of life counts more. |
| Uptime, last 30 days | Minutes down deducted proportionally. |
| Certificate | Invalid or expiring within 14 days: deduction. |
What a 71 means next to a 96
A 96 is a site with everything current and no findings; the missing points are usually a plugin one version behind. A 71 has something that needs a person today: in the example on the site-management page it is an unknown administrator plus a vulnerable ACF version. The score is there so you sort the list by it and open the lowest one first.
What it is not
It measures what the checks found, so a 100 means WebCrew found nothing in the latest check and says nothing about whether a site can be attacked. It also says nothing about page speed. Page speed per page is coming as a separate measurement.