Audit

The complete WordPress site audit.

2026-09-29 · 11 min read

An audit is not a feeling about whether the site seems fine. It is a list of specific things you look at, in an order, with a definition of what good looks like for each one. This is that list — six areas, and what to do about what you find.

Work through it top to bottom. The order is deliberate: each section is roughly ordered by how much damage the finding does, divided by how long it takes to fix. If you only have twenty minutes, the first item in each section is the one to do.

1. Updates

This is first because it is where real sites actually break and get broken.

• Is WordPress core up to date? Dashboard → Updates. Minor releases are mostly security fixes and should never be behind.
• Are any plugins out of date? Each one is a published list of what is wrong with your site, because the changelog that describes the fix also describes the flaw.
• Are any themes out of date? Including the ones you are not using.
• Is anything installed that has been closed or abandoned? A plugin removed from the WordPress directory, or with no update in three years, will not be fixed when something is found in it.
• Are automatic updates on? For plugins and themes at minimum.
• Is PHP current? Running an unsupported PHP version means security fixes stopped arriving. Your host’s control panel will tell you, and usually let you change it.

Good looks like: nothing pending, nothing abandoned, auto-updates on, PHP in support. The security checklist goes deeper here.

2. Security

• Who has an administrator account? Read the whole Users list. Look for people who left, agencies you no longer use, and anyone you do not recognise.
• Is registration open, and what does a new user become? Settings → General. If “Anyone can register” is ticked and the default role is anything above Subscriber, anyone on the internet can create an account with real power.
• Is the file editor enabled? Tools → Theme File Editor. It turns admin access into arbitrary code execution, and a typo into a white screen.
• Is your WordPress version in the page source? It does not make you vulnerable, it makes you easy to find with a scanner.
• Is XML-RPC open and unused? An interface with no legitimate traffic is pure surface area.
• Is the whole site on HTTPS? Both addresses in Settings → General.
• Do you have off-site backups you have actually restored once? An untested backup is a belief.

Good looks like: the smallest number of admins that works, registration closed or defaulting to Subscriber, file editor off, HTTPS everywhere, backups that have been proven.

3. Database

The least visible section and often the most surprising.

• How large is your autoload? Every option marked to autoload is read on every single request. A few hundred kilobytes is healthy; several megabytes is a tax on every page view. Autoloaded options covers this properly.
• How many expired transients are sitting in the options table? WordPress expires them lazily, so abandoned ones never get cleared.
• How many post revisions do you have? Uncapped by default, kept forever.
• How much orphaned post meta is there? Rows belonging to posts that no longer exist, usually left by a plugin that was removed.
• Is there leftover data from plugins you deleted? Deleting a plugin does not oblige it to clean up after itself, and many do not.

Good looks like: autoload comfortably under a megabyte, expired transients cleared, revisions capped going forward.

4. Media

• Are any images absurdly large? Anything over about 500KB deserves a question.
• Are images being served at the size they are displayed? A 4000px photo shown at 800px wastes most of what it downloads.
• Are there unattached files? Uploads not used in any post. Usually harmless, occasionally a lot of disk.
• Are thumbnails being generated? If a plugin or theme has registered twenty image sizes, every upload becomes twenty files.

Good looks like: nothing enormous, nothing being downsized in the browser, image sizes you actually use.

5. Accessibility

Most WordPress accessibility problems are content problems, not theme problems, which means you can fix them yourself without touching code.

• Do your images have alt text? The most common accessibility failure on the web, and the easiest to fix. It also happens to help image search.
• Does each page have exactly one H1? And do the headings below it descend in order, without skipping from H2 to H4 because H4 looked the right size?
• Do links say what they go to? “Read more” eleven times on a page is useless to someone navigating by link list.
• Is there a language set on the page? Screen readers use it to choose pronunciation.
• Does text have enough contrast against its background? 4.5:1 for normal text.
• Do form fields have real labels? Placeholder text is not a label — it disappears when you start typing.

Good looks like: every meaningful image described, one H1 per page, headings in order, links that make sense read aloud on their own. Checking accessibility in WordPress has the detail.

6. SEO

• Can search engines see the site at all? Settings → Reading. This single checkbox can hide everything. It is worth its own article, because of how often it is the whole answer.
• Are your permalinks readable? If URLs look like ?p=123, change it now, before more of them get indexed.
• Do you have a sitemap? WordPress has had one built in since 5.5 at /wp-sitemap.xml.
• Does every page have a title and a meta description? And are they different from each other?
• Is the site in Google Search Console? If not, you are guessing about everything else in this section.
• Are there pages returning errors? Search Console will tell you.

Good looks like: visible to crawlers, readable URLs, a sitemap submitted, Search Console verified and showing pages indexed.

How often to do this

That last row is the important one. A migration is the single most reliable way to arrive at a site that is blocked from search engines, missing its sitemap, serving mixed content and running a stale plugin — all at once, all invisibly, because everything looks fine from the front page.

Doing it without doing it by hand

Everything above can be checked manually, and it is worth doing manually once so you understand what you are looking at. After that, it is a list of things a computer should check for you, because a list of forty items checked by a human every quarter is a list that gets checked twice and then forgotten.

That is what Guru Site Health is: these six areas, 32 checks, one score, and thirteen of the findings fixable from the dashboard with an Undo on each. It runs entirely on your server and makes no external requests, so running an audit does not mean handing a description of your site to someone else.

Frequently asked questions

Keep reading

• Read nextThe WordPress Security Checklist You Can Actually Finish
• Read nextHow to Run a WordPress Performance Audit Without Guessing