WordPress Site Audit — 30-Point Checklist [2026]

A WordPress site audit is a structured review of a website for security, performance, technical SEO and infrastructure — ending with a report listing issues ordered by risk and business impact. The audit answers the question "what actually threatens this site and what is holding it back" before the first outage or ranking drop answers it instead. This guide contains the full 30-point checklist, the audit process step by step and real price ranges.

Key takeaway: A WordPress site audit costs 500–2,500 PLN net and takes from a few hours to a few days, depending on site size. It covers four areas: security, performance (Core Web Vitals), technical SEO and infrastructure (hosting, PHP, backups). An audit report should contain priorities, not just a list of findings — otherwise it remains a document that changes nothing. An audit is the standard first step before taking a site under care.

What is a WordPress site audit?

A WordPress site audit is a comprehensive review of a site's technical condition: code, configuration, plugins, performance, security and visibility in Google. It differs from a casual "quick look" in that it is methodical — it has a scope, assessment criteria and a report with recommendations.

An audit answers questions the site owner usually cannot answer.

• Does the site have security gaps that may already have been exploited?
• Why is the site slow, and which elements are responsible for the delays?
• What is blocking visibility in Google — and is the problem technical or content-related?
• Are the backups actually restorable?
• What happens when the host upgrades the PHP version or changes limits?

The audit output is a list of findings with priorities: from critical problems (fix immediately), through important (schedule), to cosmetics (consider).

When to order an audit

An audit is not needed "just in case" every month — it makes sense at specific moments. Here are five signals that it is time.

• You are taking over a site — from a previous vendor, an agency or "an uncle who built the site". The audit shows what you are taking on before you sign a care contract.
• The site has slowed down — load times increased, Core Web Vitals in Search Console turned red, users complain.
• Rankings dropped — positions are falling and you do not know why. A technical audit separates technical problems from content problems.
• Suspected infection — strange redirects, unknown accounts, spam in search results (WordPress malware removal).
• Before investing in development — before putting budget into new features, check the foundations; extending a neglected site is building on sand.

There is also a sixth, most often ignored signal: the site is several years old and nobody touches it. Outdated plugins, an old PHP version and backups "somewhere" are a time bomb.

Audit scope — four areas

A good WordPress site audit covers four areas that influence one another.

An audit is not a verdict — it is a map. Some findings take an hour to fix, others require a project. The value of the report lies in showing the order: what first, what next, and what can be consciously accepted.

WordPress site audit checklist — 30 points

The checklist below is the practical standard I use in audits. You can use it yourself or compare it with the scope a vendor offers. A printable version is available on the WordPress audit checklist page.

Security (points 1–8)

1. WordPress core version and update history — whether the site keeps up with security releases.
2. Plugin and theme list: which are current, which abandoned, which can be removed.
3. User accounts: roles, inactive accounts, accounts with administrator privileges.
4. Two-factor authentication (2FA) for all administrative accounts.
5. Restrictions on wp-admin and wp-login.php access (login attempts, lockouts).
6. Malware and file integrity scan — comparison with the core baseline.
7. WAF and server-level protection configuration (Cloudflare, host rules).
8. File and directory permissions, disabled file editing from the dashboard.

Performance (points 9–16)

9. Core Web Vitals measurement on mobile: LCP, INP, CLS — lab and field data.
10. Server-level and plugin caching: hit rate, configuration, exclusions.
11. Images: formats (WebP/AVIF), compression, dimensions, lazy loading.
12. Database load: revisions, transients, orphaned plugin tables.
13. Front-end plugin load: number of scripts, CSS, external assets.
14. Server response time (TTFB) and host I/O performance.
15. Third-party assets: fonts, maps, pixels, chat widgets — how many and how they affect LCP.
16. CDN and cache header configuration for static files.

Technical SEO (points 17–24)

17. Google index status: which URLs are indexed, which are not, and why.
18. Noindex directives and canonicals — whether key pages are excluded from the index.
19. XML sitemap: freshness, completeness, submission in Search Console.
20. Redirects: chains, loops, 301 vs 302, redirects to errors.
21. 404 and 5xx errors: count, sources, impact on crawl budget.
22. Structured data (JSON-LD): validity, consistency with page content.
23. Heading structure and internal linking: H1, hierarchy, links to key pages.
24. Mobile performance and responsiveness — rendering, tap targets, viewport.

Infrastructure and backups (points 25–30)

25. PHP and database versions relative to vendor support (PHP versions and support dates).
26. Hosting limits: PHP memory, processes, I/O, disk space — with headroom for growth.
27. Backups: frequency, retention, off-server storage.
28. Backup restore test — whether a backup actually comes up on a test environment.
29. SSL certificate and HTTPS configuration: validity, enforcement, mixed content.
30. Staging environment and deployment procedure — whether changes can be tested before production.

Thirty points sounds like a lot, but most checks are a matter of hours of work for an experienced vendor with the right tools. Interpretation is the key: the same result ("12 plugins to update") is sometimes a cosmetic issue and sometimes a red alarm — it depends on the site's context.

How the audit runs step by step

A standard WordPress site audit has five stages.

• Scope and access — agreeing what the audit covers and handing over access: panel, hosting, Google Search Console. Without Search Console, a technical SEO audit is only half done.
• Data collection — security scans, performance measurements, configuration snapshots, log exports, Google index analysis.
• Analysis — interpreting the results in the context of the site's business: what actually threatens it, what blocks its goals.
• Report — a document with findings, priorities and recommendations; ideally with repair cost estimates.
• Presentation and plan — discussing the report and a roadmap: what we fix now, what in the next quarter.

A good audit ends with a conversation, not a PDF. If the vendor sends a file and disappears, it is a sign they sell documents, not results.

How much does a WordPress site audit cost?

Audit prices depend on the size and complexity of the site.

Beware of "free audits" in sales offers. A free audit is usually an automatic scan of a dozen parameters with a machine-generated report — it can be a starting point, but it does not replace analysis. A paid audit with recommendations and repair cost estimates pays for itself at the first serious technical decision.

Audit before taking a site under care

The most common scenario where an audit has an immediate return: taking over a neglected site. The audit then answers three questions before you sign a care contract.

• What you are taking on — technical condition, list of problems, risks (infected files, no backups, PHP past EOL).
• How much it will cost to bring into order — a list of work with estimates; it is often cheaper to negotiate this before the takeover than "within care".
• Whether the site is even fit for care — sometimes the honest answer is: repair and clean-up first, then ongoing care.

The takeover process — from access inventory to the first month of care — is described step by step in the article on taking over a site. The pattern of ongoing care with quarterly reviews is broken down in the guide to WordPress website care.

What should an audit report contain?

A WordPress site audit report is only valuable if it can be acted upon. The minimum structure of a good report

• Executive summary — one page: overall condition, the three biggest risks, recommended order of action.
• Findings with priorities — each point with a risk rating (critical / important / cosmetic) and a short justification.
• Repair cost estimates — ranges for each item, so a budget can be planned.
• Evidence — screenshots, log excerpts, measurement results; without them the report is an opinion.
• Roadmap — an action plan for 30/90 days, split into "do it yourself" and "commission".

A report without priorities is a list of complaints that overwhelms instead of organising. If you receive a document with 80 points and no split into important and cosmetic, ask for a prioritised version — it is part of the service, not an add-on.

Frequently asked questions

How much does a WordPress site audit cost?

A WordPress site audit costs 500–2,500 PLN net: brochure site 500–900 PLN, company site 900–1,500 PLN, WooCommerce store 1,500–2,500 PLN, extended service from 2,500 PLN. The price depends on the number of pages, plugins and integrations, and on whether the audit includes SEO and content analysis.

What does a WordPress site audit cover?

The audit covers four areas: security (plugins, accounts, malware, WAF), performance (Core Web Vitals, cache, images, database), technical SEO (indexation, canonicals, redirects, structured data) and infrastructure (hosting, PHP versions, backups, SSL). The output is a report with priorities and repair cost estimates.

Can I audit a site myself?

Partly — the checklist in this article can be worked through on your own, and tools such as PageSpeed Insights and Search Console are free. The limit lies in interpretation: telling a critical problem from a cosmetic one requires experience with similar sites. A self-audit makes sense as preparation for a conversation with a vendor.

How long does a WordPress site audit take?

• Brochure site and blog: 1–2 business days. Company site: 2–4 days. WooCommerce store: 3–7 days. Extended service: 1–2 weeks. Time is also affected by access availability — an audit with full access to the panel, hosting and Search Console runs much faster.

Does the audit cover SEO and content?

A technical audit covers the technical foundations of SEO: indexation, canonicals, redirects, Core Web Vitals and structured data. Content, keyword and link analysis is a separate scope — an SEO audit. When ordering, clarify which variant you need; some vendors combine both in one report.

When should an audit be repeated?

• After every major change: migration, rebuild, hosting change, adding a store. Without changes, an audit every 12–18 months is enough — the WordPress world changes (PHP, browsers, Google requirements) and an "untouched" site eventually becomes a neglected one. Within ongoing care, a quarterly review replaces a full audit.

Sources and tools

• WordPress — hardening and security
• web.dev — Core Web Vitals
• Google Search Central — site maintenance
• OWASP — web application security
• PHP — supported versions
• WordPress.org — plugins

👉 Want an audit of your WordPress site? See WordPress development & care — an audit with a report and roadmap, then ongoing care. Write via the contact form or to kontakt@informatix.com.pl.

📖 See also: WordPress website care, taking over a site, WordPress malware removal and WordPress audit checklist (printable).