No indication of vulnerable state when frequency == only on change

[ssnepenthe]

When notification frequency is set to only send after scans where status has changed - you will get a single notification and then there is no further indication that your site is vulnerable.

It would be very easy to forget to update and then never receive another notification.

One option would be to drop this setting completely - it was only implemented for the email host header injection vuln which hasn't been patched for a while.

Another (probably better) option would be to have some sort of visual indication in wp-admin. This might go hand-in-hand with implementing DB notifications or could just be a flag in the settings table.