Technical WordPress audit: what a real analysis of your site actually finds

Straight answer: A technical WordPress audit is a diagnosis backed by data: which plugins you have and which are redundant, how your security stands, what is slowing the site down, and how much risk has built up. You get a report with the findings, the evidence behind each one and the order in which they are worth resolving. No jargon, no recommendations copied from a blog, and no invented urgency to sell you work you do not need.

What an audit is (and what it is not)

It is an analysis with evidence. I review your site plugin by plugin, measure what can be measured, and tell you what is happening and why.

It is not an 80-page report nobody reads. It is not a list of “best practices” copied off the internet. It is not an audit run by an automated tool that returns the same thing for everyone.

No opinions without data. No forced commitments. We tell you exactly what to do.

What I review

Plugins and dependencies. How many you have, which run on every page, which have not been updated in over a year, which overlap with each other. Abandoned plugins are the most common security risk I find, and on almost none of the sites I audit is it visible.

Speed. Core Web Vitals, DOM weight, load waterfall, TTFB, and which plugin is costing more time than it appears to.

Security. PHP version, WordPress version, file permissions, access configuration, suspicious code in themes and plugins, backup status.

Technical SEO. Titles and metadata, heading hierarchy, structured data, redirects, canonicals, robots.txt and sitemap.

Code and maintainability. Whether the theme is custom or from a vendor, whether there are undocumented customisations baked in, and how hard it would be to change themes tomorrow.

How I do it: my process in 3 phases

1. Collection (day 1)

I access a staging or read-only environment, and never change anything in production without telling you. I collect the full inventory of plugins, themes, versions and configuration. I take baseline measurements.

2. Analysis (days 2-4)

I go plugin by plugin: what it does, when it runs, how much it weighs, whether it is abandoned, whether it duplicates another one. I cross-reference the security findings with the performance ones and with the SEO ones. I come out with a list prioritised by real impact, not alphabetically.

3. Report (days 4-5)

I deliver the report with each finding, the evidence behind it, the severity and the recommended resolution order. Nothing of the “consider evaluating the possibility of implementing a load optimization strategy” variety.

What your project includes

Full inventory of plugins, themes and dependencies
Core Web Vitals, waterfall and DOM weight measurement
Security review: versions, permissions, backups, suspicious code
Technical SEO review: metadata, structure, structured data, redirects
Report with findings, evidence and severity
Prioritised resolution plan, with fixed prices per item if you decide to act

USD 290, delivered in 3 to 5 business days.

Why this is different from what you get elsewhere

Almost every audit I see starts with an automated tool and ends with a generic checklist copied from somewhere. I start by understanding what your site does and how it works, and the important things fall out of that.

A finding without evidence is an opinion. And an opinion is not enough to make a decision.

Frequently asked questions

Do you modify my site during the audit? No. I work read-only or in a staging environment. Nothing changes in production until you decide.

Is the audit free? It costs USD 290 because it means opening the site, measuring and delivering a report with judgement. What is free is the initial conversation to find out whether this is what you need.

Can I apply only some of the findings? Yes, and it is the normal case. I present the plan with fixed prices per item so you take what makes sense.

How often should I get audited? At least once a year, and before any major PHP or WordPress update.

Do you want to know what your WordPress actually contains? Send me access and in 3 to 5 days you have a diagnosis backed by data and a plan. I reply in under 24 hours.