ix
ix

informatix

PL version Book a discovery call

Free checklist

WordPress audit checklist — 30 points

Security, performance, technical SEO and infrastructure. Print it and go through your site point by point.

The checklist covers 30 checks grouped into four areas. Each point can be verified with free tools (Search Console, PageSpeed Insights, Wordfence, UptimeRobot) or manually in the WordPress panel. Mark each item as OK, to fix or to review — and start with the security section.

Full audit guide

Security

points 1–8
  1. 1 WordPress core version and update history — does the site keep up with security releases?
  2. 2 Plugin and theme list: which are current, which abandoned, which can be removed.
  3. 3 User accounts: roles, inactive accounts, accounts with administrator privileges.
  4. 4 Two-factor authentication (2FA) for all administrative accounts.
  5. 5 Restrictions on wp-admin and wp-login.php access (login attempts, lockouts).
  6. 6 Malware and file integrity scan — comparison with the core baseline.
  7. 7 WAF and server-level protection configuration (Cloudflare, host rules).
  8. 8 File and directory permissions, disabled file editing from the dashboard.

Performance

points 9–16
  1. 9 Core Web Vitals on mobile: LCP, INP, CLS — lab and field data.
  2. 10 Server-level and plugin caching: hit rate, configuration, exclusions.
  3. 11 Images: formats (WebP/AVIF), compression, dimensions, lazy loading.
  4. 12 Database load: revisions, transients, orphaned plugin tables.
  5. 13 Front-end plugin load: number of scripts, CSS, external assets.
  6. 14 Server response time (TTFB) and host I/O performance.
  7. 15 Third-party assets: fonts, maps, pixels, chat widgets — impact on LCP.
  8. 16 CDN and cache headers for static files.

Technical SEO

points 17–24
  1. 17 Google index status: which URLs are indexed and which are not.
  2. 18 Noindex directives and canonicals on key pages.
  3. 19 XML sitemap: freshness, completeness, submission in Search Console.
  4. 20 Redirects: chains, loops, 301 vs 302, redirects to errors.
  5. 21 404 and 5xx errors: count, sources, impact on crawl budget.
  6. 22 Structured data (JSON-LD): validity and consistency with content.
  7. 23 Heading structure and internal linking: H1, hierarchy, links to key pages.
  8. 24 Mobile performance and responsiveness: rendering, tap targets, viewport.

Infrastructure and backups

points 25–30
  1. 25 PHP and database versions relative to vendor support.
  2. 26 Hosting limits: PHP memory, processes, I/O, disk space — with headroom.
  3. 27 Backups: frequency, retention, off-server storage.
  4. 28 Backup restore test on a staging environment.
  5. 29 SSL certificate and HTTPS configuration: validity, enforcement, mixed content.
  6. 30 Staging environment and deployment procedure.

How to use this checklist

  1. Start with security (points 1–8) — a compromised site invalidates every other result.
  2. Mark each point as OK, to fix or to review. Do not fix everything at once — prioritise.
  3. Repeat the checklist after every major change: migration, rebuild, hosting change.
  4. For a full audit with a report and cost estimates, see the guide linked above.

Want someone to run the audit and fix the findings? See WordPress development & care.

Need a full audit?

A report with priorities, repair cost estimates and a roadmap — for a brochure site or a store.

Request an audit