A WordPress website audit is a structured check of a business site: its content, speed, security, WordPress settings and backups. Website audits and website health checks matter because the site owner gets to know what is going well and what needs improvement, before a small problem becomes a breakdown.
I have been building WordPress websites for over a decade and have done over 100 of these WordPress site audits. I have seen just about everything you can imagine, from missing Google Analytics tracking codes to suspicious code added, and I have regularly found the site being blocked from search engines altogether. This guide is based on that experience, and hopefully gives you an understanding of why it is so important to get a check-up.
On this page
- Basics: who needs one
- What the audit includes
- Why it matters for a business site
- Things every WordPress website should have
- How often should you audit a WordPress site?
- How long does a website audit take?
- Website audit cost: what to expect
- How a website audit improves SEO
- Website audit tools versus a human review
- Why a DIY site check is not enough
- Why developers should get their build audited
- After the audit: fixing what was found
- FAQ
WordPress website audit basics: who needs one
An audit is a guide to the current state of a site, written for the person who owns it rather than the person who built it. It turns data the site already produces (server logs, analytics, search performance, plugin versions, user accounts) into plain-language insights and a fix list a business owner can act on.
Who needs one:
- Business owners who inherited a WP site from a previous developer and do not know what is under the hood.
- Anyone whose visitors, enquiries or rankings have dropped without an obvious reason.
- Owners about to spend on SEO, ads or a redesign, who want the foundations checked first.
- Developers handing over a build who want an independent second set of eyes.
Search is also changing quickly because of AI Overviews and no-click results. If you are reviewing your site strategy, it is worth reading what Google's AI search changes mean for your website as part of the bigger audit picture.
If you would like me to look over your site for you, I have this service available as what I call a Website Health Check.
What a WordPress website audit includes
A website audit should include a content audit, a speed test and a security scan. Add a WordPress settings check and a backup check and you have the five parts of a thorough website health check. Together they form the audit checklist I work through on every WP site.
Content audit
The first thing is to make sure there is nothing on the site that should not be there (404 pages, broken links, orphaned test pages) and that all content is relevant and easily found. I check the navigation, the heading structure of key pages, and whether visitors can reach the important pages from the home page in one click. Headings and a table of contents that readers can use are part of this check, and so is the quality of the copy on the pages that make the business money.
Site speed test
The speed test should include a full-page load time on mobile and desktop, plus a check for any obvious errors that could be causing the site to not perform at its best, such as slow-loading images or scripts. I run Google's PageSpeed Insights, read the Core Web Vitals numbers, then look at the server response time and the theme and plugin weight behind them. If you want the plain-English version of those scores, read what Core Web Vitals scores really tell you. A site that is fast on a desktop and slow on a phone loses the visitors Google now counts first, and a site that cannot handle a traffic spike loses them all at once.
Security scan
The security scan checks WordPress core, the theme and every plugin for outdated versions and known vulnerabilities, using a public vulnerability database such as Patchstack. It then goes through the user accounts: does each user still need access, is their role more powerful than their job, and is the login protected? Protecting the WordPress login from brute-force attacks is one of the cheapest fixes on the list. I also look for file changes that do not belong, because a hacked WordPress site rarely looks hacked from the front. WordPress.org publishes a solid hardening guide, and the OWASP Top Ten lists the web application risks a secure site has to cover. Before updating anything, check plugin compatibility so the fix does not break the site.
WordPress settings check
Many settings are accessible from the WordPress dashboard, being anything from the timezone used as a time reference to the main email account responsible for the site. The check covers the site and admin email, timezone, permalinks, search engine visibility (I have found live sites still set to discourage search engines), comment settings, and whether the site runs a current PHP version. Small things like turning off comments properly stop spam and support requests later.
Backup and disaster recovery check
What kinds of backups are in place, and are they set up properly? For example, is the business owner relying on the web hosting company to back up the site, or is there a WordPress backup plugin being used? I check that a backup exists, that it is stored off the server, and that someone has actually restored from it. The Australian Cyber Security Centre publishes small-business guidance that covers backups, and it is worth a read. If you have never done a restore, disaster recovery steps for a WordPress install gone bad shows what the maintenance routine should provide, and migrating a site from a backup is the same skill.
Why it matters for a business site
A website health check should be done regularly, for the same reason you service a car: better to find an oil leak during a regular check than to blow an engine.
The owner will be able to know what is going well on the site and what needs improvement: performance, site speed, visibility in search engine results and reliability. Issues found early are cheap to fix. The same issues found after a hack, a failed update or a drop in Google rankings are not.
For a business site, the audit also protects the money already spent. Ads, SEO and social campaigns all send people to the same site, and a slow page or a broken form quietly wastes every one of them.
Things every WordPress website should have
Every WordPress website should have the following things checked: WordPress security, a solid backup system, good site speed and engaging content.
Security. A word of advice for anyone using WordPress is to always update your site when there are new updates available. This can be done by going into 'Updates' in the WP admin panel and clicking on 'Update Now', and WordPress.org walks through it in its updating WordPress guide. It is recommended that security checks are carried out on an annual basis, if not more often.
Backup system. Backup plugins can be used to automatically back up your site's files and database. Some WordPress hosting providers have these plugins preinstalled for their customer's use. The free version of the UpdraftPlus WordPress plugin is highly recommended and allows for regular backups and offsite storage of backups. Managed website hosting often provides reliable backups as part of their service, for example, WP Engine provides automatic daily backups that are straightforward to restore if something goes wrong.
Fast website. A good load time for optimal performance would be anything under five seconds, and the best practice is to aim for two seconds or less than this! This can be done by removing unnecessary plugins, JavaScript files and scripts that do not need to run on every page load, and by making sure the caching plugin is set up correctly.
Great content. Starting with the home page, with a strong content strategy that continues throughout the site. A unique selling proposition and strong calls to action can make a big impact on engagement and future traffic if done well.
Structured data. Google reads schema markup to understand what the business is, where it is and what it offers. Schema markup that tells Google what the business is now sits on my essentials list alongside the four above.
How often should you audit a WordPress site?
Once a year at a minimum, and more often when new tools are added or major changes are made to things like the theme. A check after a major WordPress update, such as the move to full site editing, is a good idea too.
Get a WP site audit for:
- New WordPress websites that you just want to be sure haven't missed anything critical as part of the build or migration process.
- Existing websites that just aren't driving traffic like you know they should be.
- Sites that have just had a new plugin, a theme change, a hosting move or a PHP upgrade.
- Just like your car and your body, an annual checkup is vital to remain healthy and reduce much larger breakdown costs later, for example after being hacked.
If you built the site yourself, even a site set up on a small budget deserves a check within its first month online.
How long does a website audit take?
Anywhere from half a day to two weeks. That covers running the speed test, security scan and content check on a WordPress site, as well as checking settings such as the backup plugin and the timezone in the admin panel.
The range depends on the size of the site, how many plugins it runs, and whether the audit stops at the report or continues into fixing what it finds. A ten-page brochure site is a half-day job. A WooCommerce store with hundreds of products, custom code and several user roles sits at the two-week end.
Knowing this helps when planning your schedule for an upcoming WP site check, so you can allow the right amount of time and know what is involved.
Website audit cost: what to expect
A WordPress site audit can cost anywhere from free to over $500 depending on who does it. A word of advice is that cheaper may not always be better when it comes to hiring someone online to check your site!
A free check normally means there is something else they would like you to do after the audit, and the check itself may be very thin in depth. Automated tools give you a score; a human review gives you a fix list in priority order.
When budgeting for an upcoming website health check, make sure the money goes towards getting a thorough report on any issues found with the site, so those areas can be improved upon. Ask what the report covers, whether it includes a walkthrough, and what the audit services include after the report is delivered.
How a website audit improves SEO
Part of any good review is a mini SEO audit: a short report of the important on-page and off-page SEO issues found, with recommendations to fix them. Once those are resolved, the change shows up in the site's search performance.
The mini SEO audit looks at page titles and meta descriptions, heading structure, image alt text, internal links, indexing (is the sitemap submitted and are the right pages showing in Google Search Console), and the schema markup Google uses to understand the business. For a Yoast user, green lights in Yoast are not an audit; they check one page against one keyword.
WordPress business owners want their sites to perform at their best when it comes to SEO, so they can rank higher for key search terms related to their industry or niche. If SEO is the main reason for the audit, the deeper SEO Website Audit goes further than the mini review, and my SEO tips and tools for WordPress cover the basics. Search is also moving into AI answers, so getting cited by ChatGPT and Perplexity is now part of the same conversation.
Website audit tools versus a human review
Free website audit tools are useful and I use several of them. PageSpeed Insights, a crawler for broken links and a WordPress vulnerability scanner will each give you data in minutes. An automated tool checks what it can see from a URL: response codes, page weight, missing meta tags, a missing sitemap, outdated plugin versions.
What a tool cannot do is judge. It does not know that the About page is three years out of date, that the contact form sends to a mailbox nobody reads, that the design hides the phone number on mobile, or that the navigation buries the service that makes the most money. It cannot tell an unused user account from a critical one, and it will give a hacked WP site a green score if the hack is tidy.
A human review starts with the tool data and adds the judgement: which findings matter for this business, in what order, and roughly what each fix will take. That is why my reports come with a video walkthrough and a priority list rather than a score. For the plugins I trust to do the automated part, see the plugins I actually use.
Why a DIY site check is not enough
WordPress website owners want to spend their time and money wisely, which is why it can be a good idea for them not to do this themselves. The reason is that they may miss something important, or an expert would know exactly what to look out for in the first place!
A website audit should help identify issues with your site, as well as give you guidance on how these could be improved upon by implementing the changes recommended during a website health check. Running the tools yourself is a fine first step; reading the results without the technical background is where owners get stuck, and where a plugin that promises to fix the score can create the next problem.
Knowing what the audit found also helps when deciding whether to get the items suggested fixed by the person doing the audit, your own internal team, or an agency or consultant that specialises in offering website support.
Why developers should get their build audited
A website audit should help a web developer identify the issues with the client WordPress sites they are building, as well as give guidance on how these could be improved upon by implementing the changes recommended during a WordPress health check.
This means they will have an up-to-date report of what is working and not working for their client's site, which can include things such as the home page content writing style, site performance, and technical items like the mini SEO audit. A second set of eyes before handover is cheaper than a support ticket after it. I covered what I learned doing this at volume in my WordCamp talk, 30 WordPress website audits in 30 days.
After the audit: fixing what was found
The report is the start, not the end. Every audit I deliver ends with a priority list, and the first steps on any WP site are the same: fix anything that is a security risk (outdated core, plugins or themes, unused admin accounts, a weak login), then anything that is broken for visitors (forms, checkout, 404s), then the speed and SEO items.
You then have three ways to get the work done: the person who did the audit, your own team, or an agency. Whoever does it, keep the report and tick items off, because the next audit starts by checking what was fixed. For sites that need someone on call, my regular WordPress support packages take care of the updates, backups and monitoring so the next check is a short one. Owners who want to learn to maintain the site themselves can join the WP AI Success Hub community.
How much do you really know about your site right now? Are there hidden problems stopping it from reaching its full potential? A WordPress site audit gives you a good understanding of what is working and what is not, by identifying the issues that need improving to ensure performance is at its best, so there are no surprises when it comes to SEO, bounce rates or broken links.
WordPress website audit FAQ
Why do a website audit?
A common question website owners have is when to do a website audit. A website health check should be done regularly. Better to find an oil leak during a regular check than blowing an engine, right? It is recommended that website audits are carried out on an annual basis, if not more often, depending on the website's needs, how often new tools are added and if major changes are made to things like the theme used. Also, after a major WordPress update like full site editing is a good idea too.
What should a website audit include?
A website audit should include content audits, speed tests and security scans. These are the main things that need to be checked for a good health check of any website, and if they are checked annually they will help keep it performing at its best. A thorough check adds the WordPress settings and the backups.
How long does a website audit take to do?
A website audit typically takes anywhere from half a day to 2 weeks to complete. This would include running the speed test, security scan and content check on any WordPress site, as well as checking settings such as the backup plugin and timezone in the admin panel.
How much does a website audit cost?
A WordPress website audit can cost anywhere from FREE to over $500 depending on who does them. A word of advice is that cheaper may not always be better when it comes to hiring someone online to complete your WordPress website audit! A free check normally means there is something else they would like you to do after this WordPress site audit, which may be very thin in depth.
How can a website audit improve your SEO?
Part of any good review will incorporate a mini SEO audit. This can help improve your SEO because it will give you a short report of the important on-page and off-page SEO issues found, as well as recommendations to fix them. This means that once these issues have been resolved, this should be reflected in your website's SEO performance!
Do I need to install a plugin for a WordPress website audit?
Not usually. Most of the audit runs from the WordPress dashboard and from external tools that read the site from the outside, so nothing needs to be installed permanently. If a scanner plugin is used during the check, ask for it to be removed afterwards.
Will I get a written audit report?
You should, so ask before you book. A proper audit ends with a written report listing every issue found, how serious it is and what to do about it, in priority order. My Website Health Check comes with the report and a video walkthrough of what it found. A score on its own is not a report.
Can I audit a WordPress site without technical skills?
You can run the free tools yourself: a speed test, a broken-link check and the Site Health screen inside WordPress. Reading the results and deciding what to fix first is the hard part, which is why owners usually hand the full audit to someone who does them regularly.
Get your WP site checked over
If you would like me to check over your WordPress website for landmines and booby traps, my Website Health Check is a one-off, obligation-free service. You get a written report and a video walking through what I found.
Related reading on The WP Guy
- Website Health Check service: what is included
- SEO Website Audit: the deeper SEO review
- WordPress regular support packages
- WordPress training for business owners
- Top 150 WordPress plugins
- WordPress plugins that I find useful
- What to do if you are not ready for a major WordPress update
- Mindmap: how to review and prepare to build a website
- WordPress for a business site
- Google Search is changing: what it means for your website
I’ve been building WordPress websites for over a decade, spoken at conferences around the world, and taught countless people how to build and maintain their sites.
I know its a jungle out there finding the right people for website development.
But I’m here to help.
Author Profile – Tony Cosentino
