Analytics and audits
Website audit
for WordPress
We check what is installed on your WordPress, which plugins their authors have abandoned and whether your backup can be restored. The result is a list of issues by severity with a plan to fix them.
Why WordPress in particular needs attention
WordPress is very popular, so it is also a frequent target of automated attacks. Bots scan websites in batches, looking for a known vulnerability in a specific version of a specific plugin.
The core receives regular updates. Plugins added over the years usually carry more risk.
What we check in the installation
- Versions of the core, theme and plugins, and known vulnerabilities
- Plugins abandoned by their authors or duplicating features
- User accounts, permissions and password strength
- Signs of a break-in: suspicious files, the mu-plugins directory, injected code
- Backups: whether they exist, where they are stored and whether they can be restored
- Performance: database queries, image sizes, cache
- SEO basics: indexing, titles, sitemap, redirects
- SSL certificate and server configuration
- Accessibility basics, privacy policy, cookie policy and consent banner
We look at the mu-plugins directory separately. Plugins in this directory load automatically, cannot be disabled from the dashboard and are easy to overlook, so we check its contents file by file.
Backups and test restores
Sometimes backups are made every night, but onto the same server the website runs on. A disk failure or ransomware encrypting the data then takes out the website and the backup at the same time.
It also happens that backups are stored off the server, but nobody has tried to restore them. That is why we restore a backup in a separate environment and measure how long it takes to get back up and running.
Where it is stored, when it was last restored and how long it will take to bring the website back after a failure. If any of these answers is missing, the audit will provide it.
Performance: what slows WordPress down
Typical causes of a slow WordPress site are images uploaded at their original camera size, plugins loading scripts on every page and no server-side caching.
Fixing it usually does not require rebuilding the website. In the audit we show how much each element weighs and where to start for the biggest gain.
Plugins: which to keep and which to remove
On websites that have been running for several years, plugins tend to pile up. Some do the same thing, some serve features that were switched off long ago, and a few were installed as a trial and simply stayed.
Every plugin means extra code and one more way in for an attacker. We check whether plugins are up to date, whether they are needed and whether their authors are still developing them.
- Plugins without updates for over a year
- Features duplicated across plugins
- Plugins that are inactive but still present in the files
- Premium solutions without a valid licence, and therefore without security patches
- Plugins loading scripts on pages where they are not used
What we do when the website is already infected
If the audit finds an active break-in, we call you straight away. The order of actions is always the same: first a copy of the infected installation, because it will be needed for analysis, then cutting off access, and only then the clean-up.
Removing the malicious code alone does not close the matter. You have to find out how the attacker got in, otherwise they may come back the same way.
After the clean-up we change passwords and security keys, review the list of administrator accounts and switch on file change monitoring.
Sudden traffic from abroad to pages you do not recognise may mean that someone has added their own content to your website and is ranking it on your domain. In that case it is worth checking the website straight away.
What the cost of the audit depends on
The cost depends on the size of the installation, the number of plugins and whether a test restore of a larger backup is needed. We quote removing an infection separately, because that is a repair, not a diagnosis.
After the audit you can keep looking after the website yourself or switch to ongoing maintenance, where updates, backups and monitoring are on our side.
Server: response time, PHP and limits
Before we start optimising WordPress, we check the server. Cheap shared hosting can be so limited that optimising the website itself achieves little: slow disks, an outdated PHP version, no server-side caching, a limit on database queries.
In the report we give measurements: server response time, PHP version and the available limits. With these figures it is easier to compare hosting offers.
If the server turns out to be the problem, we can offer our website hosting. The report remains useful whichever provider you stay with.
Accessibility and legal basics
As part of the audit we check accessibility basics: whether forms have correct labels, whether text contrast is sufficient and whether the website can be used with a keyboard.
We also review the documents: the privacy policy, the cookie policy and the consent banner linked to analytics. This is not a legal audit. We point out the areas worth consulting a lawyer about.
Working together
How we work together, step by step
Access to the dashboard and server
We read, we do not change. No modification goes in without your consent.
Analysis and testing
Security scan, performance measurement and a test restore of the backup.
Report and plan
A list of issues by severity and a proposal of what to fix straight away and what to schedule.
Questions
Frequently asked questions
No. The audit is read-only and we change nothing without your consent. If we find an active break-in, we call you straight away.
We secure a copy of the current state, cut off access, clean the installation, find the entry point, change passwords and keys and switch on file change monitoring. We quote the clean-up separately.
No. The report is yours to keep, and you can implement it yourself or hand it to someone else.
Once a year for a website that rarely changes, and after every major rebuild. Between audits, monitoring of updates and backups is enough.
Yes. We also audit websites on other systems. For online shops we have separate audits: PrestaShop and online shop audit.
Related services
What else may be useful
Your city
WordPress website audit in your city
For each of these cities we have a separate page describing the local market and how we work with companies there.
Let's check what is in your installation
Give us your website address. We will send you the audit scope and the completion date.