This check reads the settings, not the software behind them
Websitecontrole reads what a site shows from the outside: the security settings it sends, its connection, its domain and the outside services it fetches parts from. We do not test the software itself. We do not read the code or log in, and whether the platform and its extensions are up to date falls outside the check. That is a deliberate line, and it is worth knowing what is and is not in this score.
Maintenance matters at least as much
Even a site with tidy settings can be breached through outdated software: a platform, an extension or a server package with a known hole that was not closed in time. A tidy configuration helps, but it does not stop an outdated extension. Maintenance is what a secure site really comes down to.
How fast should you update?
Some platforms set hard deadlines tied to severity: critical holes immediately, high within about a month, moderate within a few months. Some systems update their own core automatically, which helps, but the extensions and themes on top are not always updated for you by default. That is exactly where active maintenance is needed: close security holes quickly, and critical ones ideally the same day.
A good score is a snapshot
The score on this site says something about how the configuration stands right now, not whether the software behind it is well maintained and still will be tomorrow. A site that scores an A today but gets no updates for six months may not be secure six months from now, and you would not know. Treat this as a starting point and a periodic check, not a seal that keeps holding.
Good settings and good maintenance are two different jobs. This tool measures the settings. The maintenance is ongoing work, and it is what keeps a site safe over time.