How to Run a Comprehensive WordPress Audit: The Full-Site Checklist

A comprehensive WordPress audit is a full-site review of your WordPress site’s technical health, security, plugins and themes, SEO, content and user experience. It finds what is broken, slow, unsafe or hard to find in search, and it turns that list into a fix order you can actually follow. This guide walks through all six areas, plus a short check for WooCommerce stores, so you can audit a whole site in one pass.

Most WordPress problems do not arrive one at a time. A site slows down because an old plugin loads extra scripts, a page drops out of search because a setting changed, and a form stops working after an update nobody noticed. An audit catches those problems together, before a visitor or a customer finds them first. You do not need paid tools or a developer to run one. You need a backup, a notebook or a spreadsheet, and a few hours set aside to look at the site the way a visitor and a search engine see it.

What this audit covers

Work through the sections in order. Each one ends with a checklist you can tick off, and the summary table near the end tells you what to fix first.

• Technical health — confirm the site loads quickly, works on phones, uses HTTPS, runs a supported PHP version and can be restored from a backup.
• Security — confirm updates are current, accounts are tight, logins are protected and nothing malicious is hiding on the site.
• Plugins and themes — confirm every plugin and theme is current, maintained and actually needed.
• SEO — confirm search engines can find, crawl and understand your pages.
• Content — confirm every page earns its place and matches what people search for.
• User experience — confirm a first-time visitor can do what they came for without friction.
• WooCommerce stores — confirm checkout, payments, shipping and tax work under real conditions.

Before you start

Take a full backup before you change anything, and keep it somewhere you can reach if the site goes down. Write down the date of the audit and the versions of WordPress, your theme and your main plugins, so the next audit has something to compare against. Work through the site in a browser you do not normally use, or in a private window, so you see it the way a new visitor does instead of the way a logged-in admin does. If anything in this guide makes you nervous, fix the backup first and change one thing at a time, checking the site after each change.

Keep a simple list as you go: what you found, where you found it, and how serious it is. A broken checkout is urgent. A missing alt attribute on one image is not. The point of the audit is not a perfect score. It is a clear list of fixes, in the right order.

1. Technical health — is the site fast, reachable and restorable?

Technical health is the foundation. If the site is slow, unreachable or impossible to restore, nothing else matters much, because visitors leave and search engines notice.

• ☐ Run the homepage and your most visited pages through PageSpeed Insights and GTmetrix, and note the scores and the slowest items instead of chasing one number.
• ☐ Open the site on a phone and a tablet. Check the menu, the buttons and the forms, and look for text that runs off the screen or elements that overlap.
• ☐ Confirm the whole site loads over HTTPS, with no mixed-content warnings and no pages served over plain HTTP.
• ☐ Check the PHP version in your hosting dashboard. PHP 8.3 or newer is the safe target, because PHP 8.1 and earlier no longer receive security updates.
• ☐ Confirm a recent backup exists, and test that you can restore from it. A backup you have never tested is a hope, not a plan.
• ☐ Click through the main navigation and the most important links. Note every broken link and every page that returns a 404.
• ☐ Check that the site loads when you are not logged in, and that the homepage, the contact page and the checkout or sign-up page all work.
• ☐ Look at the hosting and domain expiry dates, and make sure renewal is set up so the site cannot lapse by accident.

Speed deserves a closer look. Test the pages people actually land on, not only the homepage: a slow product page or a slow guide costs more than a slow homepage. If a tool flags a large image, an uncached page or a script you do not recognise, write it down and deal with it in the plugins section below. Fix the biggest, slowest items first and re-test, rather than changing ten small things at once and never knowing which one helped.

2. Security — can anyone get in who should not?

A security audit is not about being afraid. It is about closing the doors you left open, and knowing you would notice if someone tried one of them.

• ☐ Update WordPress, every plugin and the active theme, then check the site still works.
• ☐ Remove plugins and themes you do not use, including old themes kept just in case.
• ☐ Review every user account. Remove accounts nobody uses, and give each remaining account the lowest role that lets the person do their job.
• ☐ Turn on two-factor authentication for admin accounts where your setup supports it, and use strong, unique passwords.
• ☐ Add login protection: limit login attempts or add a CAPTCHA on the login page, and check that failed logins are being logged or blocked.
• ☐ Run a malware scan with Wordfence or check the site with Sucuri SiteCheck, and read the results instead of assuming a clean scan means nothing needs attention.
• ☐ Check the security headers your site sends, and confirm the site is not loading scripts from sources you do not recognise.
• ☐ Confirm you know how you would recover the site if an admin account were locked out or compromised.

Do the security section before the rest of the fixes. A fast site that is easy to break into is not a good site, and a hacked site will undo every other improvement on this list.

3. Plugins and themes — is everything current, maintained and needed?

Plugins and themes do most of the work on a WordPress site, so they cause most of the trouble too. This section is a stocktake: what is installed, what it does, and whether it should still be there.

• ☐ List every active plugin and ask what it does. If you cannot say, find out before you keep it.
• ☐ Check that every plugin and the active theme have been updated recently by their authors, and look for plugins that have been abandoned.
• ☐ Remove plugins that duplicate a feature another plugin already provides, or that solve a problem you no longer have.
• ☐ Check that the active theme is supported and works with the current version of WordPress.
• ☐ After any update, visit the pages that depend on the plugin or theme and confirm they still work.
• ☐ Keep the number of plugins as low as you honestly can, while keeping the features the site needs.

Plugins are the most common source of WordPress trouble: they slow sites down, open security holes and conflict with each other. The audit is your chance to remove the ones that only exist because they were installed once and never switched off.

4. SEO — can search engines find and understand the site?

SEO is not a trick you add at the end. It is a check that search engines can reach your pages, understand what they are about, and show them to the right people.

• ☐ Open Google Search Console and check which pages are indexed, and which pages have errors or warnings.
• ☐ Confirm the XML sitemap is present, reachable and lists the pages you want found.
• ☐ Check that each important page has a clear title and a meta description written for a human reader.
• ☐ Check the heading structure on key pages: one main heading, then subheadings in a sensible order.
• ☐ Look for pages that compete with each other for the same topic, and decide which one should rank.
• ☐ Check internal links: important pages should be linked from other pages on the site, not left orphaned.
• ☐ Check image alt text on key pages, and confirm filenames and compression are sensible.
• ☐ Check that structured data is present where it belongs, and that it matches what the page actually says.

SEO problems are often boring and invisible, which is why they survive for years. A page that is not indexed might as well not exist, and a page with no internal links is hard for both visitors and search engines to find.

5. Content — does every page earn its place?

A site grows one post at a time, and the old ones do not look after themselves. This section asks whether each page still deserves to be on the site, and whether it still says what it should.

• ☐ Find pages under about 400 words that offer no clear value, and improve them, merge them or remove them.
• ☐ Check facts, dates and screenshots, and update anything that is out of date.
• ☐ Look for posts that overlap or repeat each other, and merge the weaker one into the stronger one.
• ☐ Check that the words on the page match what people actually search for, and that the page answers the question its title promises.
• ☐ Read the most visited pages as a stranger would, and cut anything that does not help the reader.
• ☐ Check that contact details and other practical information are current.

Content audits are where most sites find their easiest wins. A merged pair of overlapping posts often ranks better than either post did alone, and an updated guide is worth more than a new post that repeats it.

6. User experience — can a first-time visitor do what they came for?

Every technical fix in this guide exists to serve one thing: a person arriving at your site and getting what they need. Test that directly, instead of guessing.

• ☐ Arrive at the homepage as a stranger and try to do the one thing the site is for, without using the search box.
• ☐ Check that the main call to action is visible without scrolling on desktop and on a phone.
• ☐ Test every form, including the contact form, and confirm the message arrives and the sender gets a reply or a confirmation.
• ☐ Check that the navigation uses words visitors understand, and that the most important pages are one or two clicks away.
• ☐ Look for pop-ups or banners that block the content, especially on a phone.
• ☐ Check that text is easy to read, with enough contrast and a size that works on a small screen.
• ☐ Watch where a new visitor hesitates, and fix the step that confuses them before you redesign anything else.

When you review page layout, it helps to see the whole page at once instead of scrolling through it in pieces. Use Full Page Fetch to capture full-page screenshots of the pages you are auditing, then look at each screenshot from top to bottom and mark anything that looks broken, crowded or unclear.

Running a store? Add a WooCommerce check

A store audit adds one more layer, because a store has money moving through it. A broken blog post is embarrassing. A broken checkout loses orders.

• ☐ Place a test order and follow it all the way through checkout, payment and the confirmation email.
• ☐ Check shipping rates and tax calculations with a real address, not only with the defaults.
• ☐ Confirm the cart, the coupon field and the payment methods all work, and that a failed payment shows a clear message.
• ☐ Check that product pages show the price, the stock status and the delivery information a buyer needs before they reach checkout.

Free tools for a WordPress audit

You can run this whole audit with free tools. Pick one tool per job, and write down what each one tells you.

• Google Search Console — shows indexing status, search queries, clicks and crawl errors for your site. Free.
• Google PageSpeed Insights — tests page speed on mobile and desktop and explains what is slowing a page down. Free.
• GTmetrix — tests page speed and shows what loads on the page. It has a free tier for occasional tests.
• Screaming Frog — crawls your site and lists broken links, missing titles, duplicate pages and redirect chains. It has a free tier.
• Wordfence — scans your WordPress files for malware and checks for known vulnerabilities. It has a free version.
• Sucuri SiteCheck — a free online scanner that checks a site for malware and blocklist status.
• WAVE — checks a page for accessibility problems such as missing labels and low contrast. Free.

How often to audit, and how long it takes

Run a full audit every six months. Audit every quarter if you run a store or change the site often, and run a quick check every month: updates, backups, broken links, Search Console errors and a speed test on the homepage. A typical small business site takes a few hours to audit properly, and a store takes longer because checkout, products and orders all need testing. Do the audit in one sitting if you can, but a checklist spread over a week beats an audit that never happens.

What to fix first

Fix in this order: security first, then indexing and crawl problems and speed, then content and user experience. A security hole can take the site down. An indexing problem can hide the site. A slow page can lose the visitor. Content and design fixes matter, but they matter most once the site is safe, findable and fast.

Your post-audit checklist

• ☐ Write down every fix, who will do it and when.
• ☐ Fix the security items first, then the indexing and speed items.
• ☐ Re-test the site after each fix, and keep a note of what changed.
• ☐ Update the backup once the fixes are done.
• ☐ Set a date for the next audit, and put the monthly quick check on the calendar.
• ☐ Keep the audit notes. The next audit starts from them.

Frequently asked questions

How often should I audit my WordPress site?

Run a full audit every six months. If you run a store or change the site often, audit every quarter instead, and run a quick check every month covering updates, backups, broken links, Search Console errors and a homepage speed test.

How long does a full audit take?

A typical small business site takes a few hours to audit properly. A store takes longer, because checkout, payments, shipping and tax all need to be tested under real conditions.

Do I need paid tools to audit WordPress?

No. The free tools in this guide cover the whole audit: Google Search Console for indexing, PageSpeed Insights and GTmetrix for speed, Screaming Frog for crawling, Wordfence or Sucuri SiteCheck for security scanning, and WAVE for accessibility.

What should I fix first after an audit?

Fix security first, then indexing and crawl problems and speed, then content and user experience. A security hole can take the site down, and an indexing problem can hide it, so those come before design and wording fixes.

Is a speed test the same as an audit?

No. A speed test measures how fast one page loads. An audit also checks security, plugins and themes, SEO, content and user experience, so it finds problems a speed test cannot see.

Keep learning

If this audit turned up a problem, the next step is a focused guide. Start with the security audit checklist, then work through the guide to speeding up WordPress and the manual SEO audit checklist. For the fixes those guides surface, read the internal linking strategy, the image SEO guide, the guide to fixing crawl errors and the XML sitemaps setup and troubleshooting guide. And if the audit found an error page, the fixes for the 500 internal server error, too many redirects and being locked out of WordPress admin are all covered step by step.

Ready to fix the most important findings first? Work through the security checks in our step-by-step WordPress security audit checklist.