WordPress security audit: your site is exposed. The question is how much.
A scanner throws 40 warnings at you. I tell you which ones matter, how risky they are and what to fix first. If you'd rather start with a quick look, the analysis is free and instant.
01 · Why this matters
You don't need to be a big target to get attacked.
Almost every WordPress site I review has something: an outdated plugin, the admin user in plain sight, files that should not be visible.
Bots scan the entire internet looking for vulnerable patterns. They don't hack you because you sell a lot: they hack you because you exist.
A compromised site drops in Google, its emails end up in spam, it scares customers away and, if it leaks data, you can end up legally liable.
It's much cheaper to find out in time than to fix later.
02 · Two levels
A WordPress audit in two levels: you start free and, if needed, I go deep.
Automatic analysis
Enter the address and see what an attacker would see from the outside. No dashboard access, nothing to install.
- XML-RPC and common attack vectors
- User enumeration
- HTTP security headers
- Exposed files and directories
- SSL/TLS certificate
- WordPress fingerprint
- Instant result, on screen
Internal audit
With temporary dashboard access I check what you can't see from outside: plugins, permissions, configuration, database.
From €390, depending on the size of the site. Report within 24-48 working hours. If you then hire me for the fix within the next 30 days, I deduct the audit from it.
- Everything in the automatic analysis, reviewed by me
- Plugins and themes: outdated and orphaned versions
- Admin users, roles and suspicious emails
- WordPress settings: open registration, debug, pingbacks…
- Malicious content in posts and suspicious files in uploads
- Database health: size, tables, overhead
- PDF report with what matters first: what to fix, why and in what order
03 · Start free
Enter the address and see it now.
No sign-up and nothing touched on your site. If what you see worries you, send me the result and I'll tell you what I'd do. Replying costs nothing.
04 · How it works
Three steps. Not one more.
1. Give me the URL
For the free analysis, the address is enough. For the internal audit, temporary dashboard access (revoked when done).
2. I analyse your website
Passive and non-intrusive checks. Your site keeps running normally, your clients don't notice a thing.
3. You get the report
The free analysis, instantly. The internal audit, in 24-48h: what was found, the risk of each item and how to fix it. No needless jargon.
05 · Frequently asked questions
What they ask me before giving me the URL.
What does a WordPress audit check?
It depends on what worries you. Here I start with security, because that's what hurts most when it fails. If your problem is speed, what you need is a WPO audit; if it's complying with the Accessibility Act, an accessibility audit. All three start from the same free analysis, and in all three you pay for the same thing: judgement about what matters.
What is the difference between the free analysis and the internal audit?
The free analysis is what anyone curious can see of your site from the Internet: headers, exposed users, detectable versions, visible files. The internal audit requires dashboard access and reviews what cannot be seen from outside: plugins with CVEs, permissions, configuration, database. The analysis finds a lot, but the internal audit finds what hurts most.
Is the analysis really free?
Yes. The result shows on screen with no sign-up; I only ask for your email if you want the full report. It's a snapshot from the outside, like any scanner's. What it doesn't give you is judgement: which of those warnings is serious in your case and which is noise. That's what the internal audit is for.
Do I have to install anything?
For the analysis, no. For the internal audit, just a temporary admin user (which you cancel when done). I do not install plugins or leave anything behind.
How long does it take?
The free analysis, about 30 seconds. The internal audit, 24 to 48 working hours.
What if you find serious issues?
I explain them in context: what it is, how risky it is, what priority to give it. If you want me to fix it, I'll send you a fixed quote and, if you hire me within the next 30 days, I deduct what you paid for the audit. If you'd rather do it yourself or with your team, the report has everything you need.
Can the audit break anything?
No. The tests are passive. I don't inject anything, I don't force anything. Your site keeps working just the same.
Do you do audits for agencies?
Yes, white-label. I deliver the report to you and never talk to your client. If you then want me to fix things, I do that behind the scenes too.
Better to know now than to find out from Google.
The security audit tells you what's exposed, how risky it is and what to fix first. If you'd rather start with no commitment, the free analysis is one click away.
Rather take a look first? Free analysis →
Is it slow too? WPO audit →
Want continuous protection afterwards? Maintenance plans →
Does your website comply with the Accessibility Act? Accessibility Audit →