What we check
What the WordPress
website audit checks.
Our WordPress website audit looks at the site the way a visitor, Google and an attacker see it. These are the six areas behind most of the problems we're asked to fix, and each one ends up in the findings as either "fine", "worth fixing" or "fix first".
What it can't see
A website health check
without your passwords.
We don't ask for logins to do the assessment. That keeps it safe and quick for you, and it means some things can only be confirmed from inside the site. We don't guess at those. They go in the findings as questions, with how to check them.
| Area | Seen from outside | Listed as a question for you |
|---|---|---|
| Updates | WordPress, theme and plugin versions the site exposes. | Plugins that leave no trace on the page, and the full update backlog. |
| Backups | Nothing reliable. A backup can't be seen from outside. | Whether backups run, where they're stored, and when one was last restored. |
| Security | Known vulnerabilities, blocklists, spam in Google, certificate, headers. | Admin users you don't recognise, file changes, login protection. |
| Hosting | Host, server response time, HTTPS setup. | PHP version (if hidden), server resources, staging. |
| Ownership | Public domain records. | Whose name the hosting, domain and admin accounts are in. |
Why the ownership question matters: the most expensive problem we see isn't a slow page. It's a site whose domain or hosting is in a former developer's name. If that's you, outsourcing website management explains how to set accounts up so you always keep control.
Example · illustrative
What the written
findings look like.
A made-up small business site, to show the format: every finding has a status, and the list ends with what we'd do first. Real findings are written for your site and are usually one page long.
Illustrative example, not a client. The 2.5-second line is Google's published "good" threshold for Largest Contentful Paint, one of the Core Web Vitals.
What happens next
After the audit:
three steps, no sales call.
We look at the live site
Platform, updates, security, speed, search basics and email, checked by the engineer, not only a tool.
You get written findings
What we found, how serious it is and what to fix first, in plain English, by email.
You decide
Fix it yourself, brief your developer, ask us, or do nothing. No chasing if you don't reply.
Free or paid?
Free website audit, audit tool
or paid WordPress audit service?
Three different things are sold as a "website audit". Each is right for someone. Here's how they compare, so you pick the one your site actually needs.
| Automated audit tool | Our free assessment | Paid WordPress audit service | |
|---|---|---|---|
| Cost | Free, or part of an SEO tool subscription. | Free. | Published packages from $599; $999 for a WooCommerce store; from $1,500 for larger sites. |
| Time | Minutes. | Written findings within one business day. | Days to weeks; one agency quotes up to 30 days. |
| Access needed | None. | None. | Usually admin, hosting and code access. |
| What you get | A score and a long list of warnings. | A short list ranked by what to fix first, with questions for what couldn't be seen. | A detailed report on code, database and architecture, often with a call. |
| Best for | A quick SEO snapshot. | Knowing what state the site is in, and what to do first. | Large stores, custom code, or a site about to be scaled or rebuilt. |
Paid prices from Codeable's published WordPress audit packages (Standard, WooCommerce and Enterprise); turnaround from WebDevStudios' WordPress website audit page. Both checked October 2026. Market figures, not our prices.
Start free, pay only if it's needed. If the findings show something that needs a closer look inside the site, we say so and quote that work as a fixed fee first. Our rates are on the pricing page.
Do it yourself
A WordPress site audit you
can run yourself in 15 minutes.
If you'd rather look first, these four free checks catch most of what a quick audit finds. Bring the results to us, or to whoever looks after your site.
Run Site Health
Tools → Site Health shows outdated PHP, inactive plugins and failed background updates. Anything under "critical issues" goes on the list.
Test on mobile
Enter your homepage and read the Core Web Vitals at the top: real-visitor data, if Google has enough of it. Red means visitors notice.
Search site:yourdomain.com
Look for pages you didn't write: pharmacy, casino or Japanese text are signs of a hacked site that Google has already found.
Check the warnings
Security issues, manual actions and the Pages report. If nobody has access to Search Console, that's the first finding.
Found spam pages in step 3? Go straight to what to do when your WordPress site is hacked. We've cleaned this exact pattern before: hundreds of Japanese spam pages on a property developer's site →
Who it's for
Who asks for a website
maintenance audit.
What we look for is what we've found. Hundreds of Japanese spam pages indexed under a property developer's domain, and a fake Google CAPTCHA that a manual search missed, are both real cases we've cleaned up. Read the case studies →
Who reads your site
The engineer who'll
write your findings.
Naveen Kumar
Founder & lead engineer · Based in Chennai, India, working 9am–6pm US Eastern with clients across the US, UK, Europe and Australia
I've maintained, repaired and cleaned up WordPress, WooCommerce and custom-coded sites for years: the code, the servers and the hacked ones. The person who audits your site is the person who'd fix it, so the findings are written to be acted on, not to sell. More about how I work →
Questions, answered
Website audit:
common questions.
Is the WordPress website audit really free?
Yes. There's no card, no call to book and no mailing list. You send the address, we look at the live site and reply in writing. If the findings show work worth doing, any quote comes afterwards and it's yours to ignore.
Do you need my WordPress login or hosting access?
No. The audit is done from the outside, the way a visitor, Google or an attacker sees the site. We never ask for passwords in the form. Anything that can only be confirmed from inside, such as whether backups run, is listed as a question for you rather than guessed.
How long does the website audit take?
You get written findings within one business day. We work 9am to 6pm US Eastern Time, Monday to Friday, so a request sent on a Friday evening is answered on Monday.
What will the written findings include?
What we checked, what we found, how serious each finding is, and what we'd fix first and why, in plain English. Things we couldn't confirm from outside are listed separately as questions. There's no score and no padding.
Is this an SEO audit?
Partly. It covers the search problems that quietly cost traffic: pages blocked from Google, broken redirects, spam pages in the index, missing sitemaps and slow mobile pages. It isn't a keyword or content strategy.
Can you audit a site that isn't WordPress?
Yes. We also assess WooCommerce stores, Webflow sites, hand-coded HTML sites and custom-built PHP applications. The checks change with the platform, and the findings say which ones applied.
What happens if you find something urgent?
It goes at the top of the findings, with what to do now. If the site is already hacked or down, don't wait for the audit: the hacked-site guide covers the first hour, and our emergency support page explains how to get help fast.
Do I have to buy anything afterwards?
No. Many people use the findings to fix things themselves or brief their current developer. If you want us to do the work, one-off catch-up work is quoted as a fixed fee, and ongoing care is a month-to-month plan.
How is this different from a free website audit tool?
A tool gives you a score and a long list. It can't tell which of 40 warnings matters, whether an old plugin is actually exposed, or what to fix first on your site. An engineer reads the results, checks what the tools miss and writes down a short, ranked list.
Can an agency send several client sites?
Yes. Each site gets its own written assessment, so you know what state it's in before anyone touches it, and any catch-up work is quoted per site as a fixed fee you can pass on or absorb.