How to Do a Security Audit on Your WordPress Site
A practical security audit any WordPress owner can run. Check for unauthorized users, outdated plugins, modified files, and suspicious login activity.
A WordPress security audit is a structured check of your site for vulnerabilities and signs of compromise. You do not need technical expertise to run a useful one. The basics take about 30 minutes and can catch problems that would otherwise go unnoticed for months.
This is a first-aid checklist, not a comprehensive professional assessment. But it finds real problems, and finding them early is far cheaper than finding them after damage is done.
Check for admin users you did not create
Log into your WordPress dashboard and go to Users. Look at every account with an Administrator role. Do you recognize all of them?
An admin account you did not create is a serious finding. It means someone gained access to your site and left a backdoor for future visits. Even if the visible damage is minimal, an unauthorized admin means the site is or was compromised.
If you find an account you do not recognize, do not delete it yet. Screenshot it, note the email address and username, then change your own password immediately. Engage a professional cleanup service before removing the account: the account may be connected to other malicious changes you have not found yet.
Check your plugins and themes
Go to your Plugins page. Look at the version number and the last updated date for every installed plugin.
Any plugin not updated in over a year is a potential risk. Any plugin with a known vulnerability that you have not patched is an active risk. Any plugin you do not actively use is an unnecessary risk.
In 2025, 91 percent of new WordPress security holes came from plugins. A plugin audit is the highest-value part of this checklist.
Repeat the same check for themes under Appearance. An old, unused theme is still running code and can still be exploited.
Check for recently modified files
If you have access to your files through your hosting panel, look for PHP files modified in the past 30 days in places you would not expect: the uploads folder, the root directory, inside plugin folders you have not recently updated.
Legitimate modifications happen in core WordPress files during updates. Suspicious modifications happen in arbitrary locations at odd times.
If you see files modified in places that make no sense, note the filenames and dates and share them with a security professional before taking action.
Check your login logs
Look for unusual login patterns. Your security plugin, if you have one, should have a record of recent logins and failed attempts. What IP addresses have logged in successfully? Do any of them look unfamiliar?
Many successful logins from unexpected countries, particularly in a short time window, suggest credential compromise. A high volume of failed attempts means a bot is actively trying to get in.
Check your domain for blacklisting
Visit MXToolbox.com and run a free blacklist check on your domain. If your domain is on any list, email was sent from your domain that triggered spam reports. This can happen without any visible sign on your site.
The honest limit of a manual audit
A manual audit finds what you know to look for. It does not find the sophisticated intrusion that left no obvious traces, the plugin vulnerability that has not been exploited yet, or the zero-day that does not show up in any signature database.
This is not a reason to skip the audit. It is a reason to understand its scope. A manual audit is a first check. Professional tools and services go further.
What you can do today
- Review your admin user list right now. This takes two minutes.
- Audit your installed plugins for anything outdated or unused.
- Run a free malware scan at Sucuri SiteCheck.
- Check your domain for blacklisting at MXToolbox.
- Look at your login logs for unusual activity.
Why this keeps happening
In 2025, researchers logged 11,334 new WordPress security holes. Running a manual audit monthly means you are checking against last month’s threat landscape, not today’s. The audit is useful and necessary. It does not substitute for continuous monitoring.
Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free. A platform with no plugins to audit, no admin users to check, and no files to scan changes what security maintenance looks like entirely.
Find out what is wrong in 60 seconds
Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.
Quick answers
What is a WordPress security audit?
A security audit is a systematic review of your site to find vulnerabilities, signs of compromise, and configuration problems. A basic audit takes 30 to 60 minutes and can be done by any site owner without technical expertise.
How often should I audit my WordPress site?
At minimum, monthly. After any major plugin update, after a WordPress core update, and any time you notice unusual behavior. The threat landscape changes continuously.
What does a professional WordPress security audit cost?
Professional security audits range from $500 to several thousand dollars depending on site size and depth. Many hosting providers offer basic scans as part of their plans.
What is the most important thing to check in a WordPress security audit?
Unauthorized admin users. An admin account you did not create means an attacker has or had access to your site. This is the highest-urgency finding in any audit.
Sixty seconds. Zero jargon.
See what's actually wrong with your site: speed, plugins, and every way in.
Check my site free