Nothing on your website is obviously broken. It loads, the forms seem to work, and yet you have a nagging sense that it is drifting away from you and no way to confirm it. Somebody has probably suggested you get the site audited, without explaining what that word covers. This article walks through what a WordPress site health audit actually checks, what each area tells you, and how to tell a real examination from a report a tool generated in eight seconds.
13 minute read · Published by WPSiteOps Team
Quick Answer
A WordPress site health audit is a point-in-time examination of the parts of a website that fail quietly: software versions, access and security posture, backups and whether they actually restore, performance and page weight, uptime history, broken links and redirects, certificate and domain expiry, database health, and whether every plugin and theme is still maintained. A real audit produces a prioritized list of findings with an explanation of what each one means for your site. An automated score produces a number.
- An audit is a snapshot, not a subscription. It tells you where the site stands today.
- The value is in the prioritization, not the length of the list.
- A clean audit is good news about today. It is not a promise about next month.
Why a site drifts without anything visibly breaking
A website does not degrade the way a machine does. There is no noise, no warning light, and no gradual loss of performance you would notice from the front page. It carries on looking exactly as it did, right up until the day it does not.
What changes underneath is undramatic. WordPress releases a new version. A plugin developer stops publishing updates. A page gets deleted and four other pages still link to it. An image library grows to three thousand files, most of them full-resolution photographs nobody resized. A certificate is set to expire in eleven months, which is a problem that will not become visible until month eleven.
Owners rarely catch this, and not because they are inattentive. You look at your website the way you look at your own front door: often, and without inspecting it. You visit the pages you always visit, on the browser you always use, already logged in. That view is genuinely useful for spotting the obvious, and our guide on how to know if your WordPress website is working covers the fifteen-minute version of it. It is also, by design, a look at the surface.
What a site health audit is, and what it is not
An audit is a defined examination of a defined list of things, carried out at one moment in time, resulting in findings that a person has read and put in order of importance.
The word has been worn thin by tools that will scan a URL and email you a red-and-green PDF in the time it takes to make tea. Those tools are not useless. They are quick at the things software is quick at: page weight, obvious errors, whether a certificate is valid. What they cannot do is judgment. A scanner can tell you a plugin is out of date. It cannot tell you that this particular plugin runs your booking system, that the update includes a change to how it stores data, and that it should be applied on a Tuesday morning with a fresh backup rather than automatically at 2am.
Two other distinctions are worth drawing early:
- An audit is not monitoring. Monitoring watches continuously and tells you when something changes. An audit examines thoroughly and tells you where things stand. They answer different questions, and neither substitutes for the other. Our article on what uptime monitoring does covers the continuous side.
- An audit is not a guarantee. It examines a defined list at a moment in time. Something outside that list can still go wrong, and something on it can change the week after. A clean audit means the site is in good order today, which is worth knowing and is not the same as being safe.
What an audit actually checks
Here is the substance of it. Each area exists because it fails quietly, and each one tells you something the others cannot.
- Updates and versions. Which versions of WordPress, plugins, and theme the site is running, and how far behind current each one is. This reveals the gap between what the site has and what has been published, including security releases applied to versions you no longer run.
- Security posture and access. Who has an account, at what level, whether two-factor authentication is in use, and whether the basic hardening steps are in place. This reveals who could get in, which is usually a longer list than the owner expects.
- Backups, and whether they restore. Not only whether a backup runs, but where it is stored, how far back it goes, and what actually comes back when it is restored. This reveals the difference between having a backup and having a recovery. Our piece on how often you need a backup covers the cadence question in more depth.
- Performance and page weight. How heavy the pages are, what is making them heavy, and how the site behaves on a phone on a normal connection. This reveals whether slowness is a hosting problem, a plugin problem, or an unresized-image problem, which matter differently.
- Uptime history. How often the site has been unreachable, for how long, and whether there is a pattern. This reveals whether your host is quietly having a bad year.
- Broken links and redirects. Internal links pointing at pages that no longer exist, and redirect chains left behind by old changes. This reveals where visitors and search engines hit dead ends, and it accumulates every time content is reorganized.
- Certificate and domain expiry. When the SSL certificate renews, when the domain renews, and whether renewal is automatic and attached to an address someone still reads. This reveals the dated risks, which are the only ones with a deadline on them.
- Database health. How much accumulated clutter the database is carrying, such as old revisions, expired temporary data, and tables left behind by plugins removed years ago. This reveals load the site is carrying for no current reason.
- Plugin and theme viability. Whether each piece of software installed is still actively maintained by someone. This reveals which parts of your site have nobody behind them, which is different from being out of date.
A good audit says one clear thing about each area rather than producing a tutorial on all nine. The point is to know where you stand, not to become an administrator.
What it costs to leave these areas unexamined
Left alone, these areas do not produce nine separate problems. They produce a handful of familiar ones, and they arrive together.
Small problems compound into a stuck update. A site three years behind cannot be brought current in an afternoon, because the versions have to be stepped through and the incompatibilities dealt with along the way. The same work done twice a year is routine. Deferred for three years, it becomes a project with a quote attached.
Recovery turns out to be theoretical. The moment you need a backup is a bad moment to learn that it only covered files and not the database, or that it stopped running in March. This is the single most common gap between what an owner believes about their site and what is true.
Dated things expire on their date. A certificate or a domain that lapses does not degrade gracefully. Visitors get a full-page browser warning, or the site simply stops resolving, and the fix is usually quick once someone notices. Noticing is the hard part when the renewal notice went to an address nobody has checked since a staff change.
Unmaintained software has nobody to call. When a plugin nobody maintains develops a problem, there is no update coming. Replacing it becomes the only option, at whatever moment it happens to fail rather than at a moment you chose.
None of this is dramatic, and none of it is inevitable. It is simply what happens to a system nobody has looked at closely for a while.
How an audit runs, and what it needs from you
The practical shape of an audit is less involved than most owners expect. It is mostly reading, and it happens without touching the live site.
- Access is arranged. Usually an administrator account on the site and, where relevant, access to hosting. An account created for the audit can be removed afterwards, and that is a reasonable thing to ask for.
- Automated checks run first. Scanning is genuinely good at collecting the raw facts: versions, page weight, broken links, certificate dates. Nobody should be gathering that by hand.
- A person reads the results. This is the part that makes it an audit. Which findings matter for this site, which are noise, and which ones only make sense together.
- The gaps automation cannot see get checked manually. Whether a backup restores. Whether the user list contains people who left. Whether the plugin doing the most work still has a maintainer.
- Findings are written down in order of importance. With what each one means in plain terms and what doing something about it would involve.
What it needs from you is access, a short conversation about what the site does for the business, and about twenty minutes at the end to go through the findings. What it does not need is for you to prepare anything or to understand the terminology in advance.
Want to know where your site actually stands?
A site health audit is included annually with Advanced Care and quarterly with Total Care, and it is available on its own if a plan is not what you need.
How to read the findings: urgent, housekeeping, optional
This is the part that separates a real audit from a generated score, and it is the part worth understanding even if you never commission one. A list of findings without an order of importance is just a longer list. Every finding belongs in one of three groups.
Urgent means it has a date, or it is already happening. A domain or certificate expiring within weeks. A backup that has not run since the spring. An administrator account belonging to someone who left the business. Software with a known security issue and a published fix. These are not urgent because they are frightening. They are urgent because waiting makes them worse or because the clock is already running.
The pattern we see when we hand over a findings list is that owners brace themselves for the security section and are then caught out by the renewal dates. Expiry is the one item on any audit that can take a site down completely, on a date that was known months in advance and written on a notice sent to an address nobody reads any more.
Housekeeping means it should be done, on a normal schedule, by someone. Updates that are a few versions behind. Broken internal links. A database carrying years of revisions. Images that were never resized. Nothing here will cause an incident this month. All of it makes the next problem harder to deal with if it is still there.
Optional means it is a judgment call and a reasonable person could leave it. A performance improvement that would shave a fraction of a second. A plugin doing a job your theme could do. A structural change that is only worth making if you are rebuilding anyway. A good audit is willing to say that something is fine as it is.
That third group is the tell. A report where everything is red and everything is critical is not describing your site, it is describing a sales process. So is a numerical score with no explanation of what would change it. Ask two questions of any audit you are given: what does this mean for my site specifically, and what on this list would you leave alone?
How often this is worth doing, and where it fits
For most small business sites, once a year is a sensible rhythm, with a second look in the year if the site changes significantly: a redesign, a host move, a change of the person looking after it, or a period where nobody was.
There are two moments when an audit earns its keep more than usual. The first is when you inherit a site, whether from an agency, a departing employee, or a previous owner. You are accepting responsibility for decisions you did not make, and it is worth knowing what they were. The second is before you invest in the site. Building new pages on a foundation nobody has examined is how a redesign turns into a rebuild halfway through.
Where it fits is the more important question. An audit is a snapshot, and a snapshot goes out of date. It tells you what to fix and in what order; it does not keep the site in that condition afterwards. That is the job of routine care, which is a different thing done at a different cadence, and our overview of what WordPress maintenance covers for a small business sets out what that looks like week to week.
The two work together. An audit finds what has drifted. Ongoing care stops it drifting again, and the next audit has less to say. That is why an annual site health audit is included in Advanced Care and a quarterly one in Total Care, rather than being sold as a separate event. If a plan is not what you want, a one-time audit is available among our one-time services.
Frequently asked questions
Once a year suits most small business sites, with an extra look after anything significant: a redesign, a move to new hosting, or a change in who looks after the site. Sites that take payments or handle bookings tend to justify a quarterly rhythm, because there is more that can quietly stop working and more at stake when it does.
Yes, as raw material. Automated tools are fast and accurate at collecting facts such as versions, page weight, broken links, and certificate dates, and no sensible audit gathers those by hand. What they cannot do is tell you which findings matter for your site, which contradict each other, or which are safe to leave. If a report gives you a score and no explanation of what would change it, you have the ingredients rather than the answer.
An administrator account on the site, hosting access where it is relevant, and a short conversation about what the site does for your business. That last part matters more than it sounds, because it decides what counts as urgent. It is entirely reasonable to create an account for the audit and remove it afterwards.
You get told what it is, what it means, and what fixing it would involve, in that order. Nothing is changed on the site as part of an audit unless you ask for it. Some findings you may want to handle yourself, some can wait for a normal maintenance cycle, and some are worth handing over. Being told which is which is the point of the exercise.
It is included rather than additional. Advanced Care includes an annual site health audit and Total Care includes a quarterly one, because ongoing care and a periodic examination answer different questions. Routine care keeps things current. An audit steps back and looks at the whole site at once, including the areas that no weekly task touches.
Knowing beats suspecting
The nagging feeling that a website is drifting is usually accurate, and it is uncomfortable precisely because it cannot be confirmed or dismissed. An audit resolves that. Sometimes the answer is that the site is in better shape than you feared, and that is a perfectly good outcome for a morning’s work.
WPSiteOps has an average client relationship of more than four years, which means we mostly see the same sites year after year and watch what actually goes wrong over time rather than guessing at it. If you would like a straight answer about where your site stands, and a findings list you can read without a translator, get in touch.
Find out where your website really stands
A read of the whole site, findings in order of importance, and a plain explanation of what each one means for your business.
Found this useful? Pass it on.
