To audit a WordPress website, work through six areas in order: core, PHP and hosting versions; plugins and themes; users and security; performance and Core Web Vitals; SEO and indexing; and backups and maintenance. Start with Tools > Site Health, run an external scan, then check the rest by hand. Record each issue with a priority.
Below is a full checklist for each area, with the WP-CLI commands that make it faster, and advice on turning your findings into a fix list.
Key takeaways
- Audit WordPress in order: versions and hosting, plugins and themes, users and security, performance, SEO, then backups.
- Start with Tools then Site Health, and check you are on PHP 8.3 or newer, as PHP 8.2 loses security fixes on 31 December 2026.
- Delete inactive plugins and themes, and replace any abandoned or nulled plugins, as these are a common source of problems.
- Make sure Discourage search engines is unticked on the live site and that you have tested restoring a backup.
What should a WordPress audit cover?
| Area | Main questions |
|---|---|
| Foundations | Is WordPress, PHP and the database up to date and supported? |
| Plugins and themes | Is everything needed, maintained and updated? |
| Users and security | Who has access, and are there obvious weaknesses? |
| Performance | Does the site load quickly and pass Core Web Vitals? |
| SEO | Can search engines crawl and index the right pages? |
| Backups and maintenance | Could you recover from a disaster tomorrow? |
Before you start, take a full backup (files and database) and, if you can, work on a staging copy. Audits sometimes involve deactivating things.
Step 1: Check the foundations
Open Tools > Site Health. The Status tab groups findings into critical issues, recommended improvements and passed tests. It flags outdated PHP, failed background updates, debug output shown to visitors, loopback failures and plugins waiting for updates. The Info tab lists versions, paths, database size and constants, and has a "copy to clipboard" button that is handy for your audit notes.
Check against current requirements. WordPress.org recommends PHP 8.3 or newer and MySQL 8.0 or MariaDB 10.11 or newer, with HTTPS support. PHP 8.1 is already end of life, and PHP 8.2 stops receiving security fixes on 31 December 2026, so plan upgrades now.
With WP-CLI on the server:
wp core version
wp core check-update
wp core verify-checksums
wp --info
verify-checksums compares core files with the official release, which is a quick way to spot modified or injected files.
Step 2: Review plugins and themes
Plugins are where most WordPress problems start: vulnerabilities, slow pages and conflicts.
wp plugin list --fields=name,status,version,update
wp theme list
wp plugin verify-checksums --all
For each plugin, ask:
- Is it active and actually needed? Delete inactive plugins and themes rather than leaving them deactivated; their code is still on the server.
- Is an update available? Update after testing.
- Is it still maintained? Check its WordPress.org page for the last update and "tested up to" version. Abandoned plugins are a security risk.
- Are there known vulnerabilities? Check a WordPress vulnerability database or your security plugin's report.
- Are there duplicates? Two SEO plugins, two caching plugins or several page builders slow the site and conflict.
- Is it a nulled (pirated) premium plugin? If so, replace it immediately. These frequently contain malware.
verify-checksums only works for plugins hosted on WordPress.org, so premium and custom plugins need checking another way.
Step 3: Check users and security
wp user list --role=administrator --fields=user_login,user_email,user_registered
wp option get users_can_register
wp option get default_role
Then check:
- Administrator accounts: remove former staff and agencies, and downgrade anyone who does not need full access.
- Registration: if
users_can_registeris on, make sure the default role is Subscriber, never Administrator. - Two-factor authentication on all admin accounts.
- Login protection: rate limiting or a firewall against brute-force attempts.
- HTTPS everywhere, with a valid certificate and redirects from HTTP. Our SSL checker confirms the certificate chain.
- Security headers such as HSTS, X-Content-Type-Options and a Content Security Policy. Test them with the MakeItFlow security headers checker.
- Exposed files:
wp-config.phpbackups,.env,.git,debug.logand old database dumps must not be downloadable. See exposed .env and .git files. - Debug mode:
WP_DEBUG_DISPLAYshould be off on a live site. - File editing in the dashboard is best disabled with
define( 'DISALLOW_FILE_EDIT', true );inwp-config.php.
Our WordPress security checklist goes deeper. If you see signs of compromise, read signs your website was hacked and use a dedicated malware scanner.
Step 4: Measure performance
Test a handful of key templates: the home page, a service or product page, a blog post and any checkout. Look at:
- Core Web Vitals: LCP, INP and CLS, using field data where available. Our Core Web Vitals guide explains the thresholds.
- Server response time (TTFB): slow TTFB on WordPress often points to weak hosting, no page caching or heavy plugins.
- Page weight: oversized images, unused CSS and JavaScript from page builders, and too many web fonts.
- Caching: page cache, browser caching headers and, for busy sites, object caching.
- Database bloat: thousands of post revisions, expired transients and large autoloaded options.
wp db size --tables --human-readable
wp transient delete --expired
wp option list --autoload=on --format=total_bytes
For fixes, see how to speed up a WordPress site.
Step 5: Check SEO and indexing
- Search engine visibility: in Settings > Reading, "Discourage search engines" must be unticked on the live site. This setting is a common reason a new site never appears in Google.
wp option get blog_public
A value of 1 means the site is visible; 0 means it is asking search engines to stay away.
- robots.txt and sitemap: confirm the sitemap is listed and that important sections are not blocked.
- Titles and meta descriptions: unique and descriptive on key pages.
- Canonical tags: pointing to the correct, preferred URL.
- Thin archive pages: tag, author and attachment pages that add nothing should usually be noindexed or redirected.
- Broken links and redirect chains after past redesigns.
- Structured data from your SEO plugin, validated rather than assumed.
Our SEO audit checklist covers each of these in detail.
Step 6: Check backups and maintenance
- Backups: automatic, daily for active sites, stored off the server, with at least 30 days kept.
- Test a restore. A backup you have never restored is a hope, not a plan.
- Updates: who is responsible, how often, and is there a staging site for testing?
- Scheduled tasks:
wp cron event listshows overdue or orphaned jobs left by removed plugins. - Uptime monitoring: alerts if the site goes down. See our website monitoring guide.
How do I turn the audit into a fix list?
Give each finding a priority:
| Priority | Examples |
|---|---|
| Critical, fix today | Discourage search engines ticked, exposed files, known vulnerable plugin, no backups |
| High, fix this month | Unsupported PHP, failing Core Web Vitals, extra admin accounts |
| Medium | Missing meta descriptions, unused plugins, database bloat |
| Low | Cosmetic SEO tweaks, minor header improvements |
Our guide to reading a website audit report explains how to weigh impact against effort.
Frequently asked questions
How often should I audit a WordPress site?
A light check monthly (updates, backups, Site Health) and a full audit every six to twelve months, or after a redesign, migration or major plugin change.
Do I need WP-CLI to audit WordPress?
No. Site Health, the plugins screen and external scanners cover most checks. WP-CLI just makes them faster and is ideal for agencies managing many sites.
Can an audit break my site?
Reading information cannot. Updating or deactivating plugins can, which is why you should back up first and test changes on staging.
Is the WordPress Site Health score enough?
It is a good start, but it only sees the server side. It does not test real-world speed, SEO, external security headers or email authentication, so pair it with an external scan.
What is the most common problem in WordPress audits?
Outdated or abandoned plugins, closely followed by sites that are slow because of heavy themes and too many plugins.
What to do next
Start with the external view, because it shows what visitors and search engines actually see. MakeItFlow detects WordPress through its technology detection and checks speed, Core Web Vitals, SEO, security headers, exposed files, DNS and email records in one scan, so you can run a free website audit before opening the dashboard. It does not scan for malware or take backups, so use a security plugin and your host's backup tools alongside it.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 21 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
