A WordPress technical audit is a structured pass through ten areas — updates, speed, mobile-friendliness, broken links, SEO basics, security, database health, site structure, duplicate content, and Core Web Vitals — to find the issues quietly costing you rankings, speed, or leads before they show up as a traffic drop. Most sites can work through it in half a day using free tools.
Run it quarterly on an active site, or immediately if you’re troubleshooting a sudden drop in traffic or speed. Here’s the full checklist, in the order worth checking things in.
Quick-reference checklist
| Area | What to check | Tools |
|---|---|---|
| Core, themes, plugins | Everything updated, no unused plugins, no conflicts | WordPress admin updates screen |
| Speed | Load time, image size, caching, minification | PageSpeed Insights, GTmetrix, Smush, WP Super Cache |
| Mobile | Responsive layout, mobile load time, tap targets | Google Mobile-Friendly Test |
| Broken links | 404s on internal/external links, missing redirects | Broken Link Checker, Screaming Frog |
| SEO basics | Sitemap, robots.txt, meta tags, canonicals, alt text | Google Search Console |
| Security | SSL, malware scan, user roles, 2FA, backups | Wordfence, Sucuri, UpdraftPlus |
| Database | Revisions, spam comments, orphaned tables | WP-Optimize, Advanced Database Cleaner |
| Structure | Navigation, internal linking, breadcrumbs | Manual review, Screaming Frog |
| Duplicate content | Duplicate tags, thin pages, content scraped elsewhere | Copyscape, Siteliner |
| Core Web Vitals | LCP, INP, CLS against Google’s thresholds | PageSpeed Insights, Search Console |
1. Check WordPress core, themes, and plugins
Outdated core files, themes, and plugins are the most common source of both security vulnerabilities and unexplained performance issues — start here before touching anything else.
- WordPress core: confirm you’re on the latest version.
- Themes and plugins: update everything active, and remove anything inactive — an unused plugin is still a security surface even when deactivated, and a deleted one is one less thing to patch.
- Plugin conflicts: if something’s behaving oddly, deactivate plugins one at a time to isolate which one is causing it.
2. Review website speed and performance
Speed affects both rankings and how many visitors stick around, so it’s worth measuring rather than guessing.
- Speed testing tools: run the site through Google PageSpeed Insights and GTmetrix to see exactly what’s slow.
- Optimize images: compress and resize large images with a plugin like Smush or ShortPixel — oversized images are the single most common cause of a slow homepage.
- Browser caching: enable caching through a plugin like W3 Total Cache or WP Super Cache.
- Minify CSS and JavaScript: reduce file sizes by minifying CSS, JS, and HTML.
- Enable Gzip compression: compresses files in transit, cutting load time further.
3. Ensure mobile-friendliness
Google indexes and ranks based on the mobile version of your site, not desktop — a site that’s fast and clean on desktop but sluggish or broken on mobile is being judged on the worse version.
- Responsive design: test with Google’s Mobile-Friendly Test tool.
- Mobile page speed: lazy-load images and prioritize above-the-fold content so mobile visitors aren’t waiting on assets they haven’t scrolled to yet.
- User experience: confirm buttons, text, and navigation are actually usable at phone screen size, not just visually present.
4. Check for broken links (404 errors)
Broken links waste crawl budget and frustrate visitors — worth a regular pass across both internal and external links.
- Broken Link Checker: the Broken Link Checker plugin or a tool like Screaming Frog will surface every 404 on the site.
- Redirects: set up 301 redirects for anything broken rather than leaving it dead.
- Anchor text: while you’re in there, confirm anchor text is descriptive rather than generic “click here” links.
5. Perform an SEO audit
A technical audit and an SEO audit overlap heavily — these are the SEO fundamentals worth confirming as part of the same pass:
- XML sitemap: up to date and submitted in Google Search Console.
- Robots.txt: correctly configured, not accidentally blocking pages you want indexed.
- Meta tags: unique titles and descriptions on every page — duplicates or auto-truncated defaults are a common finding here.
- Canonical tags: in place to prevent duplicate-content issues.
- Alt text: descriptive alt text on images, both for accessibility and image search.
6. Analyze security vulnerabilities
Security gaps rarely announce themselves until they’re exploited, which is exactly why they belong in a scheduled audit rather than a reactive fix.
- Security plugins: Wordfence or Sucuri for ongoing malware monitoring.
- SSL certificate: active and serving the entire site over HTTPS, not just the checkout or login page.
- User access: audit who has dashboard access and whether their role actually matches what they need.
- Two-factor authentication: enabled for every account with publishing or admin access.
- Backups: scheduled and actually running — UpdraftPlus or BackupBuddy, checked, not just installed.
7. Optimize the database
Years of post revisions and spam comments add up to a database that’s slower to query than it needs to be.
- Database optimization plugins: WP-Optimize or Advanced Database Cleaner remove old revisions and spam comments in one pass.
- Clean up tables: delete tables left behind by plugins you no longer run.
- Database backups: confirm these are running on their own schedule, separate from full-site backups.
8. Review website structure and navigation
Structure affects both how visitors find things and how search engines crawl and distribute authority across your pages.
- Clear navigation: simple and intuitive, for people and for crawlers.
- Internal linking: a real linking structure between related pages, not orphaned content with no path leading to it.
- Breadcrumbs: help both users and search engines understand where a page sits in your site’s hierarchy.
9. Check for duplicate content
Duplicate or thin content can suppress rankings even when every individual page looks fine on its own.
- Content duplication: Copyscape or Siteliner will flag content duplicated elsewhere, including scraped copies of your own pages.
- Duplicate tags: check for repeated title, meta description, or H1 tags across multiple pages.
- Thin content: pages under roughly 300 words rarely carry enough substance to rank — expand or consolidate them.
10. Monitor Core Web Vitals
Core Web Vitals are a confirmed Google ranking factor, and they’re the most direct read on how a page actually feels to load and use:
- Largest Contentful Paint (LCP): the page’s largest element should load within 2.5 seconds.
- Interaction to Next Paint (INP): aim under 200 milliseconds — INP replaced First Input Delay as the official interactivity metric in March 2024.
- Cumulative Layout Shift (CLS): keep it below 0.1 so content isn’t jumping around as the page loads.
How often should you run this audit?
Quarterly is enough for most active sites — frequent enough to catch a plugin update that quietly broke something, infrequent enough that it’s not a constant time sink. Run it immediately, outside that schedule, if you notice a sudden drop in traffic, speed, or Search Console impressions — those are signals something on this list already broke.
Once the audit’s done and the fixes are in, the next step is usually less about auditing and more about not having to redo this from scratch every quarter — see the complete guide to WordPress maintenance for what an ongoing plan actually covers. If the audit surfaces vulnerabilities specifically, the proactive security measures guide goes beyond the basics covered here. And if you’re running this audit on a site that hasn’t launched yet, the advanced WordPress launch checklist covers what to verify before it goes live rather than after.
If you’d rather hand the audit off entirely, that’s covered under WordPress maintenance and care plans — a full technical audit with a clear, prioritized fix list, not just a list of tools to run yourself.
