Quick answer: Before you hire WordPress help, inventory software versions, backups, security basics, speed on mobile, broken forms, and obvious SEO or content issues. Write down what you find. A clear brief saves money and makes quotes comparable. You do not need Site Health (it is not in core yet); you need a disciplined checklist and admin access notes.
This checklist is for site owners and managers. It is not a full penetration test. When something looks serious (malware, unexplained admin users), pause marketing experiments and contain the problem first (hacked WordPress site).
Why audit before you buy hours
Agencies price uncertainty. If you can say “we are on PHP 5.6, twenty outdated plugins, checkout fails on iPhone Safari, and backups are unknown,” you will get sharper proposals than “the site feels slow and weird.” Audits also stop you paying for a redesign when you really need hosting and caching.
Access and inventory (day one)
Collect:
- wp-admin credentials (or create a temporary admin for the auditor)
- Hosting panel access
- DNS provider
- CDN / security accounts (Cloudflare, Sucuri, and so on)
- Analytics and Search Console
- List of critical journeys (donate, checkout, lead form, login)
Export a plugin list (name, version, active/inactive). Note the theme and whether a child theme exists. Record WordPress version (expect 4.9.x today) and PHP version from hosting.
Updates and compatibility
Check for:
- WordPress core updates waiting
- Plugin and theme updates
- Abandoned plugins (no updates for a year or more)
- Multisite complications if relevant
Do not update production blindly before backups. Staging is ideal. PHP upgrades deserve their own plan (PHP version for WordPress, PHP 7 performance).
Backups and restore confidence
Ask:
- What backs up (files, database, frequency)?
- Where are backups stored (not only on the same server)?
- When was the last successful restore test?
If nobody knows, fixing backup is higher priority than new homepage animations. Maintenance discipline is covered more broadly in WordPress maintenance.
Security basics
- Admin user list: remove unknowns; stop using
adminas a username - Two-factor authentication for privileged users (WordPress two-factor authentication)
- SSL certificate valid sitewide (Let’s Encrypt, HTTPS migration)
- File permissions and
wp-config.phpnot public - Security plugin present and not in conflict with another (Wordfence vs Sucuri style choices)
- XML-RPC and unused APIs locked down if not needed
Search Console Security Issues and Google Safe Browsing status deserve a look.
Speed and hosting
Measure homepage, a key landing page and checkout or enquiry form on mobile with PageSpeed Insights. Note TTFB, oversized images and render-blocking stacks. Review caching (WordPress caching plugins, Cloudflare if used). Compare hosting plan to traffic. Speed work often beats a full redesign for conversion.
Google has announced a Speed Update for mobile search later this year; treating performance as optional is shortsighted.
Content and SEO hygiene
- Titles and meta descriptions unique on key templates
- One H1 per page roughly speaking
- Mixed HTTP resources on HTTPS pages
- Crawl errors in Search Console (crawl errors, Google Search Console)
- XML sitemap submitted
- Thin or duplicate tag archives flooding the index
- Broken internal links
A lightweight SEO audit or technical SEO checklist pass is enough before hiring specialists for deeper work.
Forms, commerce and critical paths
Submit every important form yourself. Place a test order on staging or with a refundable live order. Book a test appointment if you use WooCommerce Bookings. Confirm email notifications arrive and are not in spam. Check payment gateway TLS posture ahead of the TLS 1.0 PCI deadline.
Design and UX notes (lightweight)
You are not redesigning yet. Note obvious friction: unreachable CTAs on mobile, overlapping elements, hamburger-only desktop nav if it hides key links (hamburger menu), popups that block content. Capture screenshots for the brief.
Custom code and technical debt
List mu-plugins, custom plugins and child theme overrides. Unknown custom code is where quotes grow (technical debt, code audit). If only one freelancers knows the system, document that risk.
Accessibility spot checks
Keyboard through the main nav and forms. Check image alt text on a sample of pages. Note contrast issues on buttons. Flag for specialists if your audience needs stronger compliance.
Package your findings
Write a one to two page brief:
- Business goals for the next six months
- Critical user journeys
- Inventory summary (versions, hosting)
- Top ten issues ranked by risk
- Out of scope (what you do not want touched yet)
- Success metrics
Send the same brief to every vendor so quotes compare fairly. Ask for staged priorities, not only a lump-sum redesign.
What WordPress does not give you yet
There is no core Site Health screen in 4.9 like later WordPress versions introduce. Do not wait for a future dashboard. Use hosting monitors, security plugins, Query Monitor on staging, and Search Console instead.
Gutenberg remains a beta plugin; do not treat block editor readiness as the centre of an audit unless you are specifically preparing for it (prepare for Gutenberg).
Hosting and DNS red flags
- Site on an overcrowded shared plan with frequent 503s
- No staging environment available
- DNS still pointed through an unpaid freelancer account
- Email on the same failing host without monitoring
- Multiple overlapping caches (plugin + host + CDN) nobody documented
Raise these in the brief. Many “WordPress problems” are hosting problems wearing a theme.
Analytics and tag audit
List every script in GTM or hard-coded in the theme. Note duplicates (two Analytics properties firing), broken goals and unused pixels. With GDPR enforcement approaching, this inventory doubles as privacy preparation (GDPR and Google Analytics). Hiring a developer to “make it faster” without removing junk tags wastes money.
Editorial and ownership
Who can publish? Are user roles least-privilege? Do former staff still have accounts? Content ownership gaps cause both security and quality issues. Align roles before a redesign dumps more editors into an already messy admin.
Budget framing for vendors
Ask vendors to price: (A) emergency fixes, (B) stabilisation (updates, backups, security, speed), (C) improvements (UX/SEO), (D) redesign. You may only approve A and B this quarter. Clear buckets prevent a single opaque quote.
Sample timeline after the audit
Week 1: backups verified, malware scan clean, critical form fixes
Week 2: updates on staging then production, remove abandoned plugins
Week 3: caching and image weight, mobile CTA fixes
Week 4: SEO hygiene and Search Console crawl clean-up
Redesign conversations belong after the site is stable unless brand risk truly outweighs downtime risk. Stability first keeps hiring decisions honest.
FAQ
Can I audit without wp-admin?
Only superficially (front-end speed, public headers). Real audits need admin and hosting access under NDA.
How often should we re-audit?
After major launches, and lightly each quarter. Continuous maintenance reduces surprise audits.
Should the same agency audit and rebuild?
They can, but consider a second pair of eyes on security-critical findings. At minimum, keep your own copy of the report.
Is a paid crawl tool required?
Helpful for large sites, optional for small brochure sites if you are thorough manually.
Next step
A crisp audit turns vague frustration into a sequenced plan. If you want an experienced team to run the checklist and then fix what matters, start with turn visitors into customers conversations grounded in evidence, not guesses.
