WordPress Site Audit Checklist: 50-Point Review

Published April 21, 2026

WordPress Site Audit Checklist

A systematic site audit identifies problems before they impact rankings, security, or revenue. Run this checklist quarterly on every WordPress site you manage.

Performance Audit

• Run Google PageSpeed Insights — target 90+ on both mobile and desktop
• Check Time to First Byte (TTFB) — should be under 200ms
• Verify page caching is active and serving cached pages to anonymous visitors
• Check largest image on each key page — over 500KB needs optimization
• Review Core Web Vitals in Google Search Console (LCP, FID/INP, CLS)
• Test load time from multiple geographic locations using WebPageTest
• Verify CDN is active and cache hit rate is above 80%

Security Audit

• Run Wordfence or Sucuri scan — zero malware, zero vulnerabilities
• Check WordPress, theme, and plugin versions — all up to date
• Verify admin accounts — no unauthorized users, all have strong passwords
• Confirm login URL is not /wp-admin (obscure it)
• Check file permissions: directories 755, files 644, wp-config.php 600
• Verify SSL certificate is valid and not expiring within 30 days
• Review user roles — no editor or author accounts with admin capabilities

SEO Audit

• Open Google Search Console — check for crawl errors, manual actions, coverage issues
• Verify XML sitemap is submitted and indexed
• Check for duplicate title tags and meta descriptions
• Scan for broken internal links (Screaming Frog or Broken Link Checker plugin)
• Verify canonical tags are present and correct
• Check that important pages are not accidentally set to noindex
• Review structured data (JSON-LD) for errors in Google's Rich Results Test

Content Audit

• Identify posts with zero organic traffic in the last 90 days (update or consolidate)
• Check for outdated statistics, broken external links, or discontinued product references
• Review category and tag structure — too many tags create thin content issues
• Verify all images have descriptive alt text

Technical Audit

• Check PHP version — must be 8.1 minimum, 8.3 preferred
• Review error log for recurring PHP errors or warnings
• Verify database backup is running on schedule
• Check disk usage — alert if above 80% capacity
• Test staging environment sync — confirm staging matches production

SiteICO's dashboard surfaces many of these metrics automatically: uptime, performance scores, backup status, and SSL expiry are visible without running manual checks.