The assessment reads

The status checks read files, WordPress settings, update information, and server conditions. They do not repair files, run updates, or automatically change configuration.

Extra protection is a deliberate exception

Under Extra protection you can enable individual safeguards. WM Guard stores the on/off switches in WordPress and then applies WordPress filters or runtime hooks. These protections still do not write protection rules into files.

External actions only after permission

Optional online diagnostics, the vulnerability lookup, and Witte Marketing services are not one combined setting. Each group has its own permission or explicit trigger.