Where the version comes from
WordPress writes its version into several places a visitor can see: the generator tag in the page head, the version numbers on core files such as the block library stylesheet, and the RSS feed. The checker reads them in that order and tells you which one it used.
Latest, behind or insecure
The version is compared with live data from WordPress.org, which keeps a list of every release and marks each one as the latest, an older release, or insecure. Insecure means the version has security problems that a newer release fixes.
| Result | What to do |
|---|---|
| Latest release | Nothing. Keep automatic minor updates on. |
| Update available | Plan the update. Older branches get security fixes for a while, but not forever. |
| Insecure version | Update now. Back up first, and test on a staging copy if the site is busy. |
| Hidden | The site does not show its version. That is good practice, as long as updates still happen. |
Should you hide your WordPress version?
Hiding the version stops lazy scanners from picking you out, but it is not protection. Bots try known attacks on every WordPress site anyway. Running the latest version matters far more than hiding it, which is why the report counts an outdated version as a real problem and a visible version only as a small one.
The same report checks the plugins too, which are a more common way in than WordPress itself. See them first in the WordPress plugin detector, or run the full WordPress vulnerability scanner.