How to Conduct a WordPress Site Audit

A WordPress site audit is a structured review of a site’s technical health, security, performance, SEO, content, and user experience that ends in a prioritized list of fixes. A thorough audit of a typical business site takes four to eight hours and covers six areas: technical, security, plugins and themes, SEO, content, and user experience. Stores running WooCommerce add a seventh.

This is the checklist our developers work through when we audit a site. You can run it yourself, and this guide is written so you can. If you would rather see the finished product first, we publish a real sample audit report so you know exactly what a completed audit looks like.

What does a WordPress site audit cover?

A complete audit answers seven questions about your site:

1. Technical: is it fast, backed up, on current infrastructure, and working on mobile?
2. Security: is it hardened, scanned, and free of unnecessary access?
3. Plugins and themes: is every extension current, maintained, and actually needed?
4. WooCommerce: do checkout, payments, shipping, and tax work under real conditions?
5. SEO: can search engines crawl, understand, and rank the site?
6. Content: does the content match what the audience is actually searching for?
7. User experience: can a first-time visitor do what they came to do?

Each section below is a checklist you can work through in order.

Before you start: set one objective

Audits drift without a goal. Decide up front which of these you are doing, because it changes where you spend your time:

• General health check. You want to know the current state and the risks. Weight technical and security.
• Diagnosing a specific problem such as slow load times or falling traffic. Start with the relevant section and only expand if the cause is elsewhere.
• Inheriting a site someone else built. Weight plugins, themes, custom code, and access review, because you are documenting the unknown.
• Pre-redesign discovery. Weight content and SEO so you know what to keep and what to redirect.

One more decision before you begin: automated tools alone will not produce a useful audit. Scanners catch surface issues and miss anything requiring judgment, such as whether a custom plugin is maintainable or whether a checkout flow makes sense. Use tools to gather data, then review the findings yourself.

What tools do you need for a WordPress audit?

These cover most of what you need, and the majority are free:

• GTmetrix and Pingdom for page speed benchmarking with actionable waterfalls.
• Google PageSpeed Insights for Core Web Vitals measured against Google’s own thresholds.
• Google Search Console for crawl errors, indexing problems, and search performance. Free and non-negotiable.
• Google Analytics for traffic sources and user behavior.
• Your browser console for JavaScript errors and failed network requests. The fastest way to find something quietly broken.
• Semrush, Ahrefs, or Moz for keyword and backlink analysis. Powerful but paid.
• SEOPress or Yoast for on-page SEO and schema output inside WordPress.
• WAVE for a first pass at WCAG accessibility issues.
• Sucuri SiteCheck or MalCare for malware and blacklist scanning.
• MXToolbox Blacklist Check to confirm your domain is not flagged for spam or malware.

Step 1: Technical audit

Speed and Core Web Vitals

Measure against Google’s published thresholds rather than a vague sense of “fast enough”:

• Largest Contentful Paint (LCP): under 2.5 seconds
• Interaction to Next Paint (INP): under 200 milliseconds
• Cumulative Layout Shift (CLS): under 0.1

Test the homepage plus one page of each template type, on mobile as well as desktop. The usual culprits on WordPress are unoptimized images, render-blocking scripts from page builders, too many plugins loading assets sitewide, and missing caching. Fix causes in that order rather than installing another optimization plugin on top.

Backups

Confirm three things, in this order: backups run daily, they are stored off-site rather than only on the same server, and a restore has actually been tested. An untested backup is an assumption, not a safety net. Host-level backups plus an independent tool such as BlogVault gives you redundancy if the host itself has a problem.

Hosting and PHP version

Check the PHP version under Tools then Site Health. PHP 8.1 and earlier no longer receive security updates, and PHP 8.2 reaches end of life at the end of 2026, so PHP 8.3 or newer is the safe target. Updating usually improves performance as a side effect. Also note whether your host provides staging, server-level caching, and a real support channel, because those three shape every future maintenance decision.

Database

Look for a database that is unusually large for the site’s size, orphaned tables left behind by removed plugins, excessive post revisions, and bloated autoloaded options. Autoloaded data over roughly 1MB is worth investigating, since it loads on every single page request.

Mobile and accessibility

Most traffic is mobile, so test on a real device, not just a resized browser window. Check Search Console for mobile usability errors, then run WAVE on your key templates. Accessibility problems are frequently also usability problems, and in the US they carry legal exposure.

Legal and compliance

What applies depends on where you and your customers are. Confirm you have a current privacy policy, cookie consent appropriate to your audience (GDPR for EU visitors, CCPA for California), and an accessibility statement. Consent tools such as CookieYes cover the baseline but are not a substitute for knowing which rules apply to you.

Step 2: Security audit

Work through this list in order:

• Scan for malware with Sucuri SiteCheck or MalCare, and check your domain against blacklists with MXToolbox.
• Review every user account. Remove accounts that are no longer needed and demote anyone who does not need administrator access. This is the most commonly skipped step and one of the most valuable.
• Require two-factor authentication for administrators.
• Confirm the SSL certificate is valid, auto-renewing, and that no pages load mixed content.
• Check your firewall, whether at the host or through a service such as Cloudflare, and confirm login endpoints are rate-limited.
• Audit API keys and integrations. Every connected service is an access path. Confirm each key is still needed and owned by your organization rather than a former contractor.
• Verify file permissions and that editing files from the WordPress admin is disabled.

Step 3: Plugin and theme audit

Checking for available updates is the easy part. The audit is the four checks people skip:

• Last updated date. Any plugin without an update in over a year is a risk. Over two years, treat replacement as urgent.
• Necessity. Deactivated plugins still sit on the server and can still be exploited. Delete what you do not use.
• Overlap. Two caching plugins or three SEO plugins conflict more often than they help.
• Licenses. Document every commercial license, its renewal date, and who holds the account. Expired licenses stop delivering security updates, which is how sites quietly fall behind.

Also check the theme. A child theme with heavy modifications, or worse a directly modified parent theme, means updates will overwrite work. That is a finding worth documenting, and it is the single most common reason an inherited site cannot be safely updated.

Step 4: WooCommerce audit

Skip this section if you are not running a store. If you are, the stakes change: a broken brochure page costs you a lead, a broken checkout costs you orders every hour until someone notices.

• Place a real test order end to end, on mobile, including payment. Nothing else substitutes for this.
• Verify tax and shipping calculations across several regions you actually ship to.
• Confirm transactional emails (order confirmation, shipping, password reset) arrive and do not land in spam.
• Review payment gateway configuration and confirm no test or sandbox keys are live.
• Check anti-fraud and spam-order protection, plus rate limiting on account registration.
• Test product search and filtering with a realistic catalog, since these degrade badly at scale.

For a deeper version of this section, see our WooCommerce site audit.

Step 5: SEO audit

Start in Google Search Console, since it reports what Google actually sees rather than what a third-party tool estimates. Then work outward:

• Indexing. Are your important pages indexed, and is anything indexed that should not be, such as staging subdomains, PDFs, or search result pages?
• Titles and meta descriptions. Every page needs a unique one written for a human deciding whether to click, not a keyword slot.
• Heading structure. One H1 per page, logical H2s beneath it.
• Internal links. Important pages should be reachable in a few clicks and linked with descriptive anchor text.
• Broken links and redirects. Fix 404s on pages that still earn traffic, and collapse redirect chains.
• Schema markup. Confirm organization, service, and FAQ schema render correctly. This increasingly determines whether AI-generated search summaries cite you at all.
• Cannibalization. Check whether two pages compete for the same query. When they do, one usually wins a poor position and neither converts well.

Step 6: Content audit

Export every published URL and sort by traffic and conversions. Most sites find three groups:

• Performing content to update and expand.
• Underperforming content on the right topic but not ranking, usually the best improvement opportunity.
• Dead weight with no traffic and no purpose, to merge, redirect, or remove.

Then look for gaps: questions your customers ask in sales calls and support tickets that your site never answers. Support tickets are the most under-used content research source most businesses own. Finally, check for duplicate and near-duplicate pages, which are common on sites that have been through several redesigns.

Step 7: User experience audit

Walk the site as a first-time visitor with a specific goal, such as requesting a quote or finding a product. Do it on a phone. Note every point where you hesitate, because hesitation is friction and friction is lost revenue.

• Is it obvious what the business does within five seconds of landing?
• Is there a clear next step on every significant page?
• Do forms ask only for what you genuinely need?
• Does every form actually submit, and does the notification arrive?
• Is contact information easy to find?

Session recording tools such as Microsoft Clarity are free and show you where real visitors hesitate, rage-click, or abandon.

Step 8: Report and prioritize

An audit that ends in a list of 80 undifferentiated problems is not useful. Sort every finding into four buckets:

1. Critical: active security risk, broken checkout, or data loss exposure. Fix now.
2. High: measurably costing traffic or conversions. Schedule within the month.
3. Medium: worth doing, no immediate cost to leaving it.
4. Low: nice to have, batch it with other work.

Attach an effort estimate to each item so decisions can be made on cost against impact. If you want to see how a finished report is structured, ours are published on the sample audit reports page.

How often should you audit a WordPress site?

A full audit once a year suits most business sites, or every six months for WooCommerce stores and sites that change frequently. Between full audits, the routine checks (updates, backups, security scans, uptime, and Core Web Vitals) belong in ongoing WordPress maintenance rather than being saved up for an annual review. Audit sooner than scheduled if you inherit a site, suffer a security incident, see unexplained traffic loss, or are planning a redesign.

Should you do it yourself or hire someone?

Run it yourself when you have the time, your site is relatively simple, and you are comfortable in Search Console and the WordPress admin. The checklist above is genuinely most of the job.

Bring in a developer when the site has meaningful custom code, when it was built by someone you can no longer reach, when a store’s revenue depends on it, or when you need the findings to be credible to someone else, such as a board or a buyer. Reading custom code and judging whether it is maintainable is the part a checklist cannot replace.

Frequently asked questions

How long does a WordPress site audit take?

Four to eight hours for a typical business site when done manually. Larger sites, WooCommerce stores, and sites with significant custom code take longer, commonly two to three days. Automated scans finish in minutes but only surface a fraction of what matters.

How much does a WordPress site audit cost?

Professional audits generally run from several hundred to a few thousand dollars depending on site complexity and depth. Our WordPress website audit starts at $900 and includes a written report with prioritized findings and effort estimates.

Can I audit a WordPress site with free tools?

Yes, for most of it. Google Search Console, PageSpeed Insights, GTmetrix, WAVE, Sucuri SiteCheck, and your browser console are free and cover the majority of the technical, security, and SEO checks above. Paid tools mainly add keyword and backlink data.

What is the difference between a WordPress audit and a security scan?

A security scan checks for malware and known vulnerabilities, and takes minutes. An audit covers security as one of seven areas and adds judgment: whether the code is maintainable, whether the plugin stack makes sense, and what to fix first. A scan tells you if you are infected; an audit tells you why the site keeps getting into trouble.

Can you audit a site another agency built?

Yes, and that is the most common reason for an audit. Auditing an inherited site is usually the first step in a website takeover, because you cannot safely maintain a site until you know how it was built.

Want us to run the audit for you?

Our senior developers work through this checklist manually on every engagement and deliver a written report with prioritized findings, effort estimates, and costs. You can download a real sample report before deciding anything.