How exposed are you?
Lower risk of downtime, data loss and the damage a hack does to customer trust.
Security, in plain terms.
Sound familiar?
If any of these ring true, this part of the audit is where to start.
- Your plugins or WordPress version haven’t been updated in months
- Several people share one admin login, or ex-staff still have access
- Google or your browser has shown a security warning for your site
- Strange pages, spam links or redirects you didn’t create
- No two-factor login on the WordPress admin
- You’re not sure a backup exists outside your hosting account
Lower risk of downtime, data loss and the damage a hack does to customer trust.
WordPress powers more than 40% of all websites, according to W3Techs, which makes it a constant target for automated attacks. Most attacks aren’t personal. Bots scan millions of sites for known weaknesses and break into whichever ones haven’t been fixed.
Patchstack’s annual reports consistently find that the vast majority of WordPress vulnerabilities are in plugins, not WordPress itself. Each outdated or abandoned plugin is a door left open, which is why the number and quality of your plugins matters so much.
A hack costs far more than the clean-up. Your site may be taken down or flagged by Google with a warning that sends visitors away. Customers may be redirected to spam, or their data exposed. Rebuilding trust takes much longer than restoring the site.
There are legal stakes too. Since November 2018, Canada’s PIPEDA has required organizations to report breaches of personal information that create a real risk of significant harm, and to notify the people affected. If your website collects names, emails or more, security is part of protecting your customers.
The good news is that prevention is well understood and far cheaper than recovery. Timely updates, fewer and better plugins, strong logins, monitoring and tested backups stop the vast majority of problems before they start.
What happens, step by step.
Senior-led from start to finish. We’ve completed hundreds of WordPress audits, and every finding is checked by hand, not just copied from a tool.
- Check for known vulnerabilities
We compare your WordPress version, theme and every plugin against vulnerability databases such as WPScan’s, and flag anything abandoned or out of date.
- Scan for compromise
We scan files and the database for malware, injected spam and unexpected admin accounts.
- Review access
We review every user account and its permissions, login protection, two-factor authentication and password practices.
- Test the defences
We check your SSL/TLS set-up with tools like SSL Labs, your security headers, file permissions and exposed sensitive files.
- Check recovery
We confirm backups exist off-site, how far back they go, and whether they can actually be restored.
And what fixing it changes.
Typical patterns from WordPress audits, not any one client’s site.
Plugins with known, published vulnerabilities
Update, replace or remove them, then keep everything current
Closes the doors bots are actively scanning for
Former staff and contractors still with admin access
Remove old accounts, apply least privilege and add two-factor login
Far lower risk of a hijacked admin account
Missing security headers and an exposed login page
Add headers, rate-limit logins and harden configuration
Common attacks blocked before they reach WordPress
Backups only stored inside the hosting account
Daily off-site backups with periodic test restores
If the worst happens, you’re back online quickly
What you get
- Plain-language reportWith a one-page summary for decision-makers
- Priorities, rankedEvery issue by business impact and effort to fix
- A fixed quoteFor the fixes, with no obligation to go ahead
- A walkthrough callWe take you through it and answer your questions
Questions owners ask
We think we’ve already been hacked. Should we start with an audit?
If your site is down, showing spam or redirecting visitors, contact us as an urgent request instead. We’ll clean it up first, then audit to find how they got in and make sure it doesn’t happen again.
Will my site go down during the audit?
No. The audit is read-only: we look, measure and test, but we don’t change anything on your live site. Anything heavier, such as load testing, is agreed with you first and run at a quiet time or against a copy of the site.
Do you need my logins?
Not to start. A lot can be checked from the outside, the way a visitor or Google sees your site. For the full picture we ask for a WordPress admin account and, ideally, read access to your hosting. We’ll walk you through creating a separate account for us, so you never share your own password.
How long does it take, and what does it cost?
It depends on the size and complexity of your site. After a quick look we give you a fixed quote and a timeline up front, so you know both before anything starts. There’s no obligation to go ahead with any fixes afterwards.
What if we already have a developer?
That’s fine. The report is written so your own developer can act on it, and we’re happy to talk it through with them. Many owners use an audit as an independent second opinion.