{
    "title": "WordPress site audit: the 12 key checks",
    "seo_title": "WordPress Site Audit Checklist: 12 Key Checks",
    "h1": "WordPress site audit: the 12 key checks",
    "description": "WordPress site audit checklist: speed, mobile, SSL, updates, plugins, sitemap, 404s, cookies, backups, security, accessibility and logs.",
    "lead": "The twelve checks of a full WordPress site audit, the free tool and threshold for each, a reusable checklist and a method to rank fixes by priority.",
    "language": "en",
    "locale": "en-US",
    "type": "article",
    "url": "https://www.wp-masquerade.com/wordpress-site-audit-checklist/",
    "canonical": "https://www.wp-masquerade.com/wordpress-site-audit-checklist/",
    "markdown": "https://www.wp-masquerade.com/wordpress-site-audit-checklist/index.md",
    "json": "https://www.wp-masquerade.com/wordpress-site-audit-checklist/index.json",
    "published": "2026-07-19T06:00:00+00:00",
    "modified": "2026-11-05T20:53:47+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "WordPress site audit: the 12 key checks",
            "url": "https://www.wp-masquerade.com/wordpress-site-audit-checklist/",
            "markdown": "https://www.wp-masquerade.com/wordpress-site-audit-checklist/index.md",
            "json": "https://www.wp-masquerade.com/wordpress-site-audit-checklist/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Auditer un site WordPress : les 12 points importants à vérifier",
            "url": "https://www.wp-masquerade.com/fr/audit-site-wordpress-points-importants/",
            "markdown": "https://www.wp-masquerade.com/fr/audit-site-wordpress-points-importants/index.md",
            "json": "https://www.wp-masquerade.com/fr/audit-site-wordpress-points-importants/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Auditar una web WordPress: los 12 puntos clave que revisar",
            "url": "https://www.wp-masquerade.com/es/auditoria-web-wordpress-puntos-clave/",
            "markdown": "https://www.wp-masquerade.com/es/auditoria-web-wordpress-puntos-clave/index.md",
            "json": "https://www.wp-masquerade.com/es/auditoria-web-wordpress-puntos-clave/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "WordPress-Website auditieren: die 12 wichtigsten Prüfpunkte",
            "url": "https://www.wp-masquerade.com/de/wordpress-website-audit-pruefpunkte/",
            "markdown": "https://www.wp-masquerade.com/de/wordpress-website-audit-pruefpunkte/index.md",
            "json": "https://www.wp-masquerade.com/de/wordpress-website-audit-pruefpunkte/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Audit di un sito WordPress: i 12 punti chiave da verificare",
            "url": "https://www.wp-masquerade.com/it/audit-sito-wordpress-punti-chiave/",
            "markdown": "https://www.wp-masquerade.com/it/audit-sito-wordpress-punti-chiave/index.md",
            "json": "https://www.wp-masquerade.com/it/audit-sito-wordpress-punti-chiave/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Auditoria de site WordPress: os 12 pontos importantes a verificar",
            "url": "https://www.wp-masquerade.com/pt/auditoria-site-wordpress-pontos-importantes/",
            "markdown": "https://www.wp-masquerade.com/pt/auditoria-site-wordpress-pontos-importantes/index.md",
            "json": "https://www.wp-masquerade.com/pt/auditoria-site-wordpress-pontos-importantes/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "WordPress-website auditen: de 12 belangrijkste controlepunten",
            "url": "https://www.wp-masquerade.com/nl/wordpress-website-audit-controlepunten/",
            "markdown": "https://www.wp-masquerade.com/nl/wordpress-website-audit-controlepunten/index.md",
            "json": "https://www.wp-masquerade.com/nl/wordpress-website-audit-controlepunten/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "WordPress site audit: the 12 key checks"
        },
        {
            "level": 2,
            "text": "Full audit, SEO audit, security audit: which one do you need?"
        },
        {
            "level": 2,
            "text": "What you need before you start"
        },
        {
            "level": 2,
            "text": "The twelve checks and their thresholds"
        },
        {
            "level": 2,
            "text": "Performance and mobile"
        },
        {
            "level": 2,
            "text": "Maintenance: updates, plugins, PHP"
        },
        {
            "level": 2,
            "text": "Indexing: sitemap and 404 errors"
        },
        {
            "level": 2,
            "text": "Compliance: cookies, legal pages and accessibility"
        },
        {
            "level": 2,
            "text": "Backups, security and logs"
        },
        {
            "level": 2,
            "text": "The checklist to reuse for every audit"
        },
        {
            "level": 2,
            "text": "Keeping the site under control between audits"
        },
        {
            "level": 3,
            "text": "Updates for all your sites on one screen"
        },
        {
            "level": 2,
            "text": "Frequently asked questions",
            "id": "faq"
        },
        {
            "level": 3,
            "text": "Key takeaways"
        },
        {
            "level": 2,
            "text": "Sources"
        },
        {
            "level": 2,
            "text": "WordPress security, without the noise",
            "id": "wpm-nl-box-title"
        }
    ],
    "body": "Auditing a WordPress site means spending half a day checking what slows it down, what puts it at risk and what puts it on the wrong side of the law, then ranking the fixes by priority. Here are the twelve checks that matter, the free tool for each, the threshold at which you need to act, and a checklist you can reuse for every audit.\n\n## Full audit, SEO audit, security audit: which one do you need?\n\nThis guide covers the full site audit: the one you run on a site you are taking over, a site you are about to redesign or a site nobody has looked at for a year. It deliberately skims over two areas that have their own method:\n\n- **In-depth SEO** (content, tags, internal linking, rankings): see [our SEO audit method for WordPress sites](https://www.wp-masquerade.com/wordpress-seo-audit/).\n- **Security, item by item**: see the 40-point WordPress security checklist.\n\nA full audit helps you decide: fix what is there, switch hosts, rebuild, or hand over maintenance? It gives you the big picture, which the two specialist audits then examine in detail.\n\n## What you need before you start\n\n- A WordPress administrator account and, ideally, SFTP or SSH access (with [WP-CLI](https://www.wp-masquerade.com/glossary/wp-cli/), several checks take ten seconds).\n- Access to the domain’s Google Search Console property, and to the host’s customer area for logs and backups.\n- A private browsing window, to see the site as a visitor does (cookie banner, cache, redirects).\n\n## The twelve checks and their thresholds\n\n| Check | Free tool | Good sign | Needs fixing |\n| --- | --- | --- | --- |\n| Loading speed | PageSpeed Insights | LCP ≤ 2.5 s, INP ≤ 200 ms, CLS ≤ 0.1 | Any metric rated “poor” on mobile |\n| Mobile display | Lighthouse, browser device mode | No horizontal scrolling, buttons easy to tap | Text too small, unusable menus |\n| HTTPS certificate | Browser, SSL Labs | Valid, renewed automatically, everything on HTTPS | Expiry close, mixed content |\n| Pending updates | Dashboard, WP-CLI | Nothing pending for more than a week | Plugin several versions behind |\n| Unused plugins | Plugins list | Every plugin has a job | Deactivated or abandoned plugins |\n| PHP version | Site Health | PHP 8.3 or later | End-of-life version |\n| Sitemap | Search Console | Submitted, no errors | Excluded URLs or URLs with errors |\n| 404 errors | Search Console, logs | Only worthless addresses | Old pages with inbound links |\n| Cookies and GDPR | Private browsing, browser tools | No tracker before consent | Rejecting harder than accepting |\n| Backups | Host, plugin | Off-server copy, restore tested | Never restored, copy on the same server |\n| Security | Site Health, checklist | Two-factor authentication, restricted access | Unknown administrators, exposed login |\n| Accessibility | Lighthouse, WAVE | Alt text, contrast, keyboard | Form fields without labels |\n\n*The Core Web Vitals thresholds are Google’s (75% of visits); the others are good-practice benchmarks.*\n\n## Performance and mobile\n\nRun the home page and your three most visited pages through PageSpeed Insights, on the mobile tab. Field data (what real visitors experience) matters more than the lab score. The three [Core Web Vitals](https://www.wp-masquerade.com/glossary/core-web-vitals/) measure how long the largest element takes to appear (LCP), how quickly the page responds to clicks (INP) and how stable the layout is (CLS). Common causes on WordPress: uncompressed images, a heavy page builder, no page caching, an overloaded server.\n\nGoogle retired its “Mobile-Friendly Test” at the end of 2023: use Lighthouse (built into Chrome and Edge) and actually browse the site on a phone, including menus, forms and the checkout.\n\n## Maintenance: updates, plugins, PHP\n\nTools > Site Health already gives you a report (PHP version, updates, inactive plugins, late scheduled tasks). With WP-CLI, the inventory is faster:\n\n```\nwp core version && wp core check-update\nwp plugin list --update=available --fields=name,version,update_version\nwp plugin list --status=inactive --fields=name,version\nwp theme list --fields=name,status,version,update\nwp eval 'echo PHP_VERSION;'\n```\n\nA deactivated plugin can still be exploited if it contains a vulnerability: delete whatever you do not use. Also look for plugins that have not been updated for more than a year (see how to spot abandoned plugins). For PHP, WordPress recommends version 8.3 or later; older versions no longer all receive security fixes, as explained in [our PHP version timeline](https://www.wp-masquerade.com/end-of-life-php-versions/).\n\n## Indexing: sitemap and 404 errors\n\nSince WordPress 5.5, an [XML sitemap](https://www.wp-masquerade.com/glossary/xml-sitemap/) is generated at `/wp-sitemap.xml`, unless an SEO plugin replaces it. Check that it is submitted in Search Console and that the “Pages” report shows no unexpected exclusions. In the same report, the [404 errors](https://www.wp-masquerade.com/glossary/404-error/) that matter are old pages that still receive links: redirect them to the closest equivalent. 404s triggered by bots probing for vulnerabilities, on the other hand, are normal.\n\n## Compliance: cookies, legal pages and accessibility\n\n- **Cookies**: open the site in a private window, then developer tools, Storage (or Application) tab. No non-essential analytics or advertising cookie should be set before the visitor makes a choice, and under PECR the ICO expects rejecting to be as easy as accepting.\n- **Required pages**: an up-to-date privacy policy (forms, plugins that collect data, retention periods), the company details your country requires, and terms of sale for an online shop.\n- **Accessibility**: in the EU, the European Accessibility Act has applied since 28 June 2025, notably to e-commerce (micro-enterprises providing services are exempt). Even where it is not mandatory, check alt text, contrast, keyboard navigation and form labels.\n\n## Backups, security and logs\n\nA backup that has never been restored is an assumption. Ask where the copies are stored, how long they are kept, and restore one to a staging site (method in [our 3-2-1 backup guide](https://www.wp-masquerade.com/wordpress-backups-3-2-1-strategy/)). On the security side, the full audit sticks to the strong signals: unknown or too many administrator accounts, a login page exposed without rate limiting, no two-factor authentication, sensitive files reachable from the web (`debug.log`, `.zip` or `.sql` archives in the root folder).\n\nFinally, read a week of server error logs: repeated PHP errors point to an incompatible plugin, and spikes of requests to `wp-login.php` or `xmlrpc.php` point to automated attacks.\n\n*A useful audit ends with priorities, not a score.*\n\n## The checklist to reuse for every audit\n\nWordPress audit checklist (12 checks)\n\n- PageSpeed Insights mobile: LCP, INP and CLS in the green on key pages\n- Full walkthrough on a phone: menu, forms, checkout\n- Valid certificate, automatic renewal, no mixed content\n- Core, plugins and themes up to date, no update pending for more than a week\n- Inactive or abandoned plugins deleted\n- PHP 8.3 or later\n- Sitemap submitted, “Pages” report with no unexpected exclusions\n- 404s on old pages redirected\n- No tracker before consent, rejecting as easy as accepting\n- Off-server backup successfully restored to a staging site\n- Administrators reviewed, two-factor authentication, login protected\n- Alt text, contrast, keyboard and error logs checked\n\nThen rank each issue into three levels: **critical** (security, data, site down: this week), **important** (mobile performance, compliance, updates: this month), **minor** (fine-tuning: to schedule). An audit that ends with fifty unranked recommendations will never be acted on.\n\n*The official tour of the Site Health tool, from the WordPress channel (May 2024): the best starting point for an audit, with nothing to install.*\n\n## Keeping the site under control between audits\n\nA yearly audit cannot see the vulnerability disclosed the next day. WP Masquerade Pro keeps part of the audit running continuously: every day, each site reports the state of its updates (WordPress, plugins, themes, PHP version) and its [known vulnerabilities](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) to your member area, the [integrity check](https://www.wp-masquerade.com/features/wordpress-integrity-check/) flags any modified core file, and the [security headers](https://www.wp-masquerade.com/features/security-headers/) are set without touching the server. It is not a performance tool, a malware scanner or a backup solution: for those checks, keep the tools mentioned above.\n\n### Updates for all your sites on one screen\n\nThe free version already reduces WordPress fingerprints and protects the login. Pro adds tracking of updates and vulnerabilities for all your sites in the member area: €59 excl. VAT per year for one site, €149 excl. VAT for 10 sites, €399 excl. VAT for 100 sites.\n\n[See Pro pricing](https://www.wp-masquerade.com/pricing/)\n\n[Download the free version](https://www.wp-masquerade.com/download/)\n\n## Frequently asked questions\n\n**How long does a WordPress site audit take?**\n\nFor a brochure site, allow half a day with the free tools listed here. An online shop or a site with a member area takes longer: checkout, accounts, personal data and performance under load.\n\n**How often should you audit your site?**\n\nOne full audit a year, plus one before any redesign or change of host. In between, continuous monitoring of updates, vulnerabilities and uptime prevents nasty surprises.\n\n**Do you need a PageSpeed score of 100?**\n\nNo. What counts is the Core Web Vitals field data on mobile: LCP, INP and CLS within Google’s thresholds. An average lab score with good real-world data is not a problem.\n\n**How is it different from an SEO audit?**\n\nA full audit checks that the site is fast, up to date, compliant and secure. An SEO audit analyses content, tags, internal linking and rankings in detail. The two complement each other: a slow or hacked site loses traffic, however good its content.\n\n### Key takeaways\n\n- Twelve checks cover the essentials: speed, mobile, HTTPS, updates, plugins, PHP, sitemap, 404s, cookies, backups, security, accessibility.\n- Core Web Vitals thresholds: LCP ≤ 2.5 s, INP ≤ 200 ms, CLS ≤ 0.1, on mobile.\n- Delete unused plugins: even deactivated, they can still be exploited.\n- A backup only counts once it has been restored.\n- Finish with three priority levels, not a score.\n\n## Sources\n\n- web.dev: Web Vitals and recommended thresholds (https://web.dev/articles/vitals)\n- WordPress.org: the Site Health screen (https://wordpress.org/documentation/article/site-health-screen/)\n- ICO: cookies and similar technologies (https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/)\n- WordPress.org: requirements (https://wordpress.org/about/requirements/)\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.",
    "categories": [
        "WordPress guides"
    ],
    "format": "application/json"
}