Contact Us
Free WordPress security audit for agencies
Send us a client site. We run a read-only review from the outside, John goes through every finding himself, and you get a signed report with a prioritized fix list in 2 to 3 business days.
1
What you get
- A health score across 10 areas, from security and plugins to performance and SEO
- Evidence behind every finding: the header, file or version we actually saw
- A roadmap sorted into fix now, fix soon and improve over time
- A plain-language summary you can walk your client through
- A note from John, who reviews and signs every report
2
What we don’t do
No logins, no plugins installed, no changes to the site, no load testing. We look at what the site shows the outside world, the same view an attacker gets, and we tell you plainly what that view can’t reach.
Request your free audit
Send us the site. It is a read-only review from the outside, so nothing on the site changes. Report in 2 to 3 business days.
It isn’t an automated scan with a logo on it. The checks run on our own auditing tool, custom-built in-house, but a person decides what matters on your specific site, ranks it by real-world risk, and tells you the one thing to fix first.
What does the free audit check?
Ten areas: front end and accessibility, SEO, performance, WordPress core, plugins and themes, the database, the server, security, content and code quality, and privacy. From the outside we can fully check some, partly check others, and a few need access we don’t ask for in a free review. The report says which is which, area by area.
| Area | From the outside | What we look at |
|---|---|---|
| Front end and accessibility | Checked | Layout across screen sizes, broken images and links, console errors, accessibility basics |
| SEO | Checked | Titles, headings, canonicals, indexability, sitemap, robots.txt, structured data |
| Performance | Checked | Core Web Vitals, page weight, render-blocking files, image handling, server response time |
| WordPress core | Partly | The version the site discloses, and whether it’s a supported branch |
| Plugins and themes | Partly | Versions visible from the outside, abandoned plugins, known vulnerabilities for those versions |
| Database | Needs access | Listed as not assessed in the free review |
| Server | Partly | SSL certificate and configuration, HTTPS redirects, HSTS, caching and compression signals |
| Security | Partly | Exposed sensitive files, username leaks through the REST API, security headers |
| Content and code quality | Checked | Broken links, duplicate content signals, markup errors |
| Privacy | Checked | Cookie consent, privacy policy, forms collecting data securely |
Exposed files are checked by requesting them and recording only the response status. We never download their contents.
What’s in the report?
A short summary for a non-technical client, a score for each area, the facts about the site’s setup, a prioritized fix list, and the full findings with the evidence for each one. It ends with an honest list of what the review couldn’t see and why.
That last part matters. An outside review can’t see the PHP version, file permissions, the database or the user accounts, and a report that pretends otherwise isn’t worth much. If the findings point at something deeper, you’ll know exactly what a full audit with access would add. When the site is one you’re about to take over, pair the report with our website handoff checklist.
The report, in order
- Executive summary
- Health score for each of the 10 areas
- Snapshot of the site’s setup
- Fix now, fix soon, improve over time
- Every finding with its evidence and fix
- What we couldn’t assess, and why
Why is the audit free?
Because it’s the clearest way to show how we work. You see the thinking before you spend anything, and the report is yours to use however you like.
Fix the findings with your own team, or send them to us for a fixed quote you can mark up and bill under your brand. If the site is already in trouble, our WordPress project rescue service picks up from there, and our guide to cleaning up a hacked WordPress site covers what to do first if you suspect a compromise. There’s no sales sequence attached to the request. John reads it, and the report is the reply.
Frequently asked questions
Is the WordPress security audit really free?
Yes. There’s no fee and no obligation. We review requests individually, so we may ask a question or two before we start.
Will you log in or change anything on the site?
No. The free audit is read-only and runs from the outside. We don’t need logins, we don’t install anything, and nothing on the site changes.
Do I need my client’s permission?
You need to own the site or manage it for the client, and the request form asks you to confirm that. If you’re about to take a site over, get the client’s go-ahead first.
How long does the audit take?
The report arrives by email within 2 to 3 business days. The checks themselves are quick; the time goes into John reviewing the findings and deciding what actually matters for that site.
What can’t an outside audit see?
Anything behind the login: the PHP version, file permissions, the database, user accounts and login hardening. The report lists each of those as not assessed, so you know where a deeper audit would add value.
Can I share the report with my client?
Yes. It opens with a plain-language summary written for exactly that conversation, and the fix list is sorted so the client can see what’s urgent and what can wait.
Send us the site
A read-only review, a signed report, and a clear list of what to fix first, in 2 to 3 business days. For builds and fixes, our white-label WordPress team works under your brand.