A score under 100% after running security tests is normal. The suite checks many settings, and not every site can pass every check.
When a test fails, open Details next to the result. That panel explains the issue and suggests what to do next.
Warnings are still warnings
Some results are warnings, not emergencies. For example, the MySQL version check may warn when you run an older but still supported database release. Changing that often depends on your host, and it may not be urgent.
Read the detail text before you treat every red result as an active compromise.
A failed test does not mean you will be hacked
Every site has different constraints. File permissions on wp-config.php, for example, cannot be tightened the same way on every host. Some hosts need looser permissions for the site to function. The detail panel usually explains alternatives.
Harder items such as a full Content Security Policy need careful testing. A wrong CSP can break scripts and styles on the site.
Issues worth prioritizing
Focus on problems you can fix and that reduce real attack surface.
Default admin username
If an administrator named admin still exists, create a new administrator with a unique username, then delete or demote admin. Details: User “admin” with administrator privileges.
Default database table prefix
WordPress defaults to the wp_ table prefix. A custom prefix blocks many generic SQL injection scripts that assume wp_. Change this carefully, preferably on a new install or with a trusted migration process and a full backup.
Related: Security Tests overview, Fixes.
