The Perimetry Cloud – Security Score plugin shows the score of your site’s domain in the WordPress admin, under Settings › Perimetry Cloud and in a widget on the dashboard. It works on every plan, Free included, and without an account for the free check.

Install it

Install the plugin, then activate it. It is coming to the WordPress plugin directory; until then, ask us for the zip file.

Nothing is sent to Perimetry Cloud until an administrator presses a button.

The free check, without an account

Press Check my domain. In about two minutes, the page shows the score of the domain and its three most serious problems, like the free check on our site.

To make sure the request comes from the site itself, Perimetry Cloud asks the site to show a one-time code at its own address, reads it, then runs the check. A site that does not show the code gets no check: nobody can use the plugin’s check on someone else’s domain. The same domain gets one check a week; asking again within the week shows the same result.

Connect the site

Press Connect or create a free account: Perimetry Cloud opens in your browser.
Sign in, or create a free account.
Choose the workspace and press Connect the site.
You are sent back to WordPress, connected.

The domain of the site is added to the workspace if it is not there yet, within the limits of your plan.
The site receives a key that can only read the score and findings of its own domain. It cannot change anything, and it does not work with the API.
Only owners and admins of a workspace can connect a site.

Prove ownership from the site

Once connected, press Prove ownership with this site: the site shows Perimetry Cloud a code at its own address, Perimetry Cloud reads it, and the domain is proved. The full audits start a few minutes later.

The site proves the domain only from the domain itself or its www (example.com or www.example.com). A site at blog.example.com proves the domain with the DNS record only.

A domain proved by its website is checked again on the site once a day. Changing DNS records from Perimetry Cloud (one-click DNS fixes, DMARC step by step) still needs the TXT record: add it, press Check now on the domain’s page, and the domain is proved by DNS from then on.

Findings in WordPress

On a connected site, the plugin’s page shows the score and grade, how it changed since the previous audit, and every open finding with its fix. Open the full report takes you to the domain’s page in Perimetry Cloud. The dashboard widget shows the grade and the open findings by severity.

What WordPress itself shows

The plugin also reads what only WordPress can see: updates waiting for WordPress, plugins and themes, a version of PHP that no longer receives security fixes, errors shown to visitors, file editing from the admin, XML-RPC, registration open with administrator as the default role, many administrator accounts, inactive plugins. This list is shown on the plugin’s page, to administrators only.

With your consent (Send this report to Perimetry Cloud once a day), the site sends this report to Perimetry Cloud once a day: the versions, the plugins and themes with their version and the update waiting, and these settings, with the number of administrators, never who they are. The domain’s page in Perimetry Cloud then has a WordPress card with the points to fix. Untick the box to stop.

Disconnect

Press Disconnect from Perimetry Cloud in WordPress, or Disconnect the extension on the WordPress card of the domain’s page in Perimetry Cloud. The key stops working and what the site reported is deleted. Removing the plugin from WordPress deletes everything it kept on the site.

For agencies

Install the plugin on each client site and connect each one to your workspace: each site’s domain joins your workspace. Your clients see their score in their own dashboard.