WordPress Site Health Check and Security Audit

Most WordPress sites grow over the years: plugins pile up, developers come and go, and nobody is sure who has access to what or whether the backup actually works. A health check gives you that picture in one go, before a problem turns into an outage, a hack or lost orders.

The result is a written report. Every finding is explained in plain language, rated by severity (critical, important, advisory) and tied to a specific fix. You decide what we do, what your current developer does and what you leave for later.

What the work includes

• Users and permissions. We review administrators, forgotten accounts, access left with former staff and developers, and usernames that are easy to guess.
• File permissions and configuration. We check folder and file permissions, protection of wp-config.php, publicly reachable log and backup files, and whether files can be edited from the admin panel.
• Plugins and themes. We find outdated, abandoned and known-vulnerable plugins, unused themes, and nulled or otherwise suspicious code.
• Login exposure. We assess how well wp-login.php and XML-RPC are protected against automated password guessing, and whether two-factor authentication is in use.
• Backups and a restore test. We check that backups run, where they are stored and how old they are, then actually restore one on a test environment. A backup that has never been restored is an assumption.
• PHP, database and server. We compare PHP, MySQL/MariaDB and web server versions with supported releases and look at memory and time limits.
• Error logs and conflicts. We read PHP and server error logs and look for plugin and theme conflicts and slow or failing queries.
• Monitoring and SSL. We check certificate validity and setup, redirects, and whether anyone would be told if the site went down.
• Email deliverability. We review SPF, DKIM and DMARC records and whether the emails your site sends (orders, forms, password resets) really reach the inbox.

Typical findings

The same things tend to come up: an administrator account belonging to someone who no longer works at the company; a plugin that has not been updated for years and has a publicly known vulnerability; a backup stored on the same server as the site itself; a PHP version that is out of official support; and form emails landing in spam because there is no DMARC record. All of these can be fixed, but only if someone knows about them.

What we need from you

• WordPress administrator access, preferably a separate account you delete afterwards.
• Hosting or server access (FTP/SFTP, SSH or the hosting panel) and read access to the domain’s DNS.
• Background on past work: who maintains the site, whether a staging copy exists and any special requirements such as a shop or payments.

What is not included

• Fixing the findings. That is a separate job, quoted from the report. For updates and PHP changes see WordPress and plugin updates and PHP version upgrades.
• Cleaning up a site that has already been hacked. That is its own job: WordPress malware removal.
• Legal advice or a formal compliance audit. The report is a technical review, not a legal opinion.
• Penetration testing against external systems.

Who it suits

It suits sites nobody has reviewed systematically for a long time: inherited sites, sites before a change of developer or host, shops where downtime costs money, and sites that have already had a scare. If you would like someone to keep watching and fixing on a regular basis, the audit is a natural step towards a monthly website maintenance plan. If you already have a specific PHP error, start with fixing PHP errors instead.