I’ve been thinking about an idea that could be really useful for those of us running WordPress sites with CPfence.
What if there was a lightweight plugin that showed the site’s security level, based on both CPfence data and a few local checks?
The idea would be to display an overall security score (0–100%), calculated from several factors, for example:
Security headers (HSTS, CSP, Referrer-Policy, etc.) – 20%
Admin account (checks if the “admin” username still exists) – 10%
Login endpoints (check if wp-login.php can be changed to a custom URL) – 10%
WordPress core, plugin and theme updates – 15%
Vulnerable plugins (based on WPScan or similar databases) – 15%
CPfence protection (firewall active, spam protection, MRTP, etc.) – 20%
HTTPS / TLS status and HSTS enabled – 10%
At the end, the plugin could display something like:
“Security: 94% – Protected by CPfence”
There could also be an optional public badge, such as “Protected by CPfence”, to increase visitor trust.
It would work a bit like WP Defender, but much lighter, without heavy background processes, and with real integration with CPfence to show blocked attacks and firewall status.
What do you think? Would this kind of plugin be useful?
