PLAIN-ENGLISH REPORT, NO JARGON
WordPress security audit
A methodical check of your WordPress site for the problems that actually get small business websites hacked: outdated or abandoned plugins, weak admin accounts, exposed files, missing backups and server settings that make attacks easier.
You get a prioritised report in plain English, and you decide what to fix. £75 per hour, with an estimate before I start.
Sample findings
- HIGHContact form plugin is two versions behind and has a publicly known vulnerability.
- HIGHA database backup file can be downloaded by anyone who guesses its name.
- MEDIUMThree administrator accounts belong to people who no longer work with you.
- LOWNo DMARC record, so others can more easily send email pretending to be you.
Examples of the kind of issues an audit finds, not from a real client.
What I check
Most hacked small business sites weren’t targeted. They were found by automated tools looking for known weaknesses. These checks cover the weaknesses those tools look for.
Plugins, themes and WordPress core
- Every plugin, theme and WordPress version checked against public vulnerability databases
- Plugins that have been abandoned or removed from the WordPress.org directory
- Pirated (“nulled”) premium plugins or themes, a common source of malware
- Whether your PHP version is still supported and receiving security fixes
Malware and file integrity
- WordPress core and plugin files compared with the official versions to spot tampering
- Scans for known malware, suspicious PHP files in uploads, injected code and hidden spam links
- Unexpected redirects, and whether Google has flagged the site as unsafe
Users and logins
- Administrator accounts reviewed: old staff, unknown users, shared logins, an “admin” username
- Two-factor authentication and limits on repeated login attempts
- Whether usernames can be discovered from the outside, and whether XML-RPC is exposed
Server and configuration
- HTTPS set up properly, with a valid certificate and no mixed content
- Security headers, debug mode and error logs that reveal too much
- Backup, database or configuration files left where anyone can download them
- Directory listing, file permissions and the built-in file editor
Backups and recovery
- Whether backups are running, how often, and where they’re stored
- Whether copies are kept off the server, and whether a restore has ever been tested
Domain and email
- SPF, DKIM and DMARC records that stop criminals sending email as you
- Domain expiry date and registrar lock
How the audit works
1
Send me the details
Your website address, and administrator access to WordPress and your hosting. I’ll set up my own login, so you don’t need to share your password.
2
Get an estimate
I take a quick look at the size and setup of your site and tell you how long the audit should take, before any work starts.
3
The audit
I take a full backup first, then work through every check. The checks are read-only and won’t change or slow down your site.
4
Your report
A plain-English report of everything I found, ranked by risk, with what each finding means and how to fix it. I’m happy to talk it through.
What this audit isn’t
It isn’t a penetration test. I don’t try to break into your site or run attack tools against it. If you need a penetration test, for example for an insurer or a compliance standard, you’ll need a specialist security firm. For most small business websites, fixing what this audit finds removes the risks that matter most.
Price
£75 per hour. You’ll get an estimate before I start, and only pay for the time actually spent. Fixes are optional, at the same rate.
Ask for an estimateSecurity audit questions
How much does a security audit cost?
Audits are charged at £75 per hour. Before I start, I’ll give you an estimate based on the size and setup of your site, so there are no surprises, and you only pay for the time actually spent.
Will the audit break or slow down my site?
No. I take a full backup first, and the checks only read and compare information. Nothing on your site is changed unless you ask me to fix something afterwards.
Is this the same as a penetration test?
No. A penetration test is a controlled attempt to break into your site, usually needed for compliance or large systems, and is done by specialist firms. My audit finds the far more common weaknesses that get small business sites hacked: outdated software, weak logins, exposed files and missing backups.
Will you fix what you find?
If you’d like me to. Fixes are charged at the same hourly rate, or your own developer can use the report. If you join a care plan, keeping on top of these issues becomes part of your regular maintenance.
My site has already been hacked. Is an audit what I need?
Not first. You need the site cleaned up. I offer a one-off emergency clean-up for £149; get in touch and tell me what’s happening.
Do I need to give you my password?
No. You add me as a user, or I set up my own named login with your permission, and you can remove my access when the audit is finished.