Security score
The Security score card of Sentinel > Dashboard rates the protection of the shop out of 100, and lists under its ring the actions that would bring it to 100. The To do card of the same page takes up these actions, each with a button that leads where to act. This page explains how the module computes the score.
The ring
The card shows the score in a ring that fills up to it, with the figure in its centre and, under it, the word of its rating: Good, Needs improvement or At risk. The colour of the ring follows the rating, but the figure and the word say it without the colour. A screen reader reads the ring as one sentence that gives the score and its rating: Security score: %score% out of 100, good, Security score: %score% out of 100, needs improvement or Security score: %score% out of 100, at risk.
How the score is computed
The score is 100 minus the penalties: each signal that is not met takes off its points, and nothing else counts. The module computes it each time Sentinel > Dashboard is displayed, from what it already knows of the shop: the settings of the protections, the plan, and the summaries of the last vulnerability scan and of the last integrity check. The Refresh button of the page updates the figures, not the score: reload the page to compute it again.
Rating
Under the figure, a word rates the score:
| Rating | Score |
|---|---|
| Good | 85 or more |
| Needs improvement | 60 to 84 |
| At risk | below 60 |
Signals and penalties
| Signal | Penalty | Action shown |
|---|---|---|
| No vulnerability scan | 24 | Run a scan, or Scan result unavailable: Sentinel service unreachable when the Sentinel service is unreachable |
| Critical vulnerabilities in the last scan | 6 each, 18 at most | Fix %count% critical vulnerabilities, or Fix 1 critical vulnerability |
| High severity vulnerabilities in the last scan | 2 each, 6 at most | Fix %count% high severity vulnerabilities, or Fix 1 high severity vulnerability |
| Threat detection row not Active | 16 | Enable threat detection, or Download Signatures when its row has the note Waiting for signatures |
| Direct PHP File Access Protection row not Active | 6, or 0 in Monitoring | Enable the direct PHP file access protection, Follow the activation of the direct PHP protection when its row has the note Activation In Progress, or Fix the direct PHP file access protection when its row has the note Needs fixing or Conflict with another auto_prepend_file |
| Brute-force Protection row not Active | 6 | Enable brute-force protection, or Brute-force protection suspended until the Sentinel service responds when its row has the note Subscription not verified: Sentinel service unreachable |
| DDoS Protection row not Active | 6, or 4 in Monitoring | Enable DDoS protection, Switch DDoS protection to blocking when it only monitors, or DDoS protection suspended until the Sentinel service responds when its row has the note Subscription not verified: Sentinel service unreachable |
| Access control row not Active: switched off, or switched on with an empty list | 6 | Enable access control, or Add your IP addresses to the access control when its row has the note Empty list: nobody is blocked |
| Two-factor authentication row not Active: the policy of the shop is off, or no profile is Required | 10 | Require two-factor authentication, or Require two-factor authentication for at least one profile when its row has the note No profile is required to use it |
| Files flagged by the last integrity check: modified, missing or unknown | 4, whatever their number | Review %count% flagged files, or Review 1 flagged file |
| Themes or folders the last integrity check left unchecked | 2 | Verify the themes and folders left unchecked |
| No integrity check | 6 | Run a check, or Integrity check result unavailable: Sentinel service unreachable when the Sentinel service is unreachable |
A protection row is the one of Your protections, and its notes are those of Notes under a row. A row in Pro required costs as much as one switched off (see Free plan). The Direct PHP File Access Protection in Monitoring costs nothing: what keeps it from blocking is threat detection (see Signature detection on direct accesses), which already costs its 16 points. Each vulnerability counts as the last scan gives it, those marked as fixed included: these are the figures of the Last Vulnerability Scan card of the same page.
Bounds
The penalties add up to 80 at most: 24 for the scan, 50 for the six protections (16 + 6 + 6 + 6 + 6 + 10) and 6 for the integrity check. The score therefore goes from 20 to 100. A measure never taken costs as much as its worst result: no scan costs 24, as much as 3 critical and 3 high severity vulnerabilities, and no integrity check 6, as much as flagged files and an incomplete check together. No shop gains anything by not measuring.
Free plan
On a plan that does not include them, five coverages count as missing, whatever their settings:
- Threat detection: 16
- Direct PHP File Access Protection: 6
- Brute-force Protection: 6
- DDoS Protection: 6
- Integrity Check: 6
They take off their points like a protection switched off, but give no action of their own: the shop could not carry it out without the Pro plan. Together they make a single Upgrade to Pro action, worth the sum of their points, which names under its label the coverages it brings; in To do, its button is Upgrade Now.
On the free plan, all five are missing: 40 points. A free shop that has done everything the free plan allows therefore scores 60, Needs improvement, with Upgrade to Pro +40 as its only action, and no free shop scores more than 60. This cap is intended: the score measures what protects the shop, and these coverages protect it.
Threat detection and the direct PHP file access protection are missing on the free plan only; the brute-force protection, the DDoS protection and the integrity check on any plan that does not include them: on a paid plan that lacks only the brute-force protection, Upgrade to Pro only carries its 6 points. A shop whose plan includes all five never sees this action. During an outage of the Sentinel service, see When the Sentinel service does not answer.
A brute-force or DDoS protection whose row has the note Subscription not verified: Sentinel service unreachable (see Notes under a row) is not a missing coverage: it costs its 6 points with its own action, which says it is suspended until the service responds.
Actions
Under the ring, a title counts the actions: %count% actions to reach 100, or 1 action to reach 100 when only one is left. Each action follows with its label and its gain as +N, the points it would add to the score. The actions come highest gain first; between equal gains, in the order of the table, and Upgrade to Pro after all the others. Their gains add up to what the score lacks of 100: a score of 72 shows actions worth 28 points in all. At 100, the title says Your shop has every protection the score measures and no action is listed.
Each action is a link to the screen where to act, the same as its button in To do:
- an action on a protection opens its tab of Sentinel > Configuration: Threat detection for threat detection and the direct PHP file access protection, then Brute force, DDoS, Access control and Two-factor authentication;
- an action on the scan opens Sentinel > Security Scanner, and an action on the integrity check Sentinel > Integrity Check;
- Upgrade to Pro opens the Pro offer in a new browser tab or, when no offer is known, the General tab of Sentinel > Configuration.
The links to Sentinel > Configuration are only given to an employee who can configure the Sentinel module (see Who can change the settings); the actions count all the same for the others.
What does not change the score
- the age of the measures: a scan run a year ago weighs as much as one run yesterday;
- your own two-factor authentication: only the policy of the shop counts, as on the Two-factor authentication row of Your protections;
- medium and low severity vulnerabilities;
- the number of flagged files beyond the first: 4 points from one file on;
- the prerequisites check: its categories that are not met join To do without any points.
Freshness of the measures
The summaries of the last scan and of the last integrity check are read again from the Sentinel service at most every 5 minutes; in between, the score uses the summary kept. A scan that ends in Sentinel > Security Scanner or with the sentinel:scan command is read again as soon as it ends: the score and step 5 of the getting started guide count it at the next display. When it cannot be read again then, the next dashboard asks the Sentinel service for it. An automatic scan or an integrity check can therefore take up to 5 minutes to change the score.
When the service is unreachable, the score uses the last summary kept, whatever its age; without any, it counts the measure as never taken, under Scan result unavailable: Sentinel service unreachable or Integrity check result unavailable: Sentinel service unreachable.