Every audit starts the same way: you send me your site URL, and fifteen minutes later you get back three things I’d fix first: no jargon, no sales pitch, no obligation to sign up for anything. People are sometimes surprised it’s really that fast. It’s fast because I’m not exploring: I’m running through the same checklist every time. Here’s exactly what’s on it.
Security
Is WordPress core current? Are the theme and every active plugin updated? This is the single biggest factor in whether a site is at risk: the overwhelming majority of WordPress hacks exploit a known vulnerability in something that was never updated. I also look for abandoned plugins still installed and active long after anyone stopped using the feature they added, a common and easy-to-miss risk. And I check the SSL certificate: valid, no browser warnings, no plain-http pages hiding somewhere in the site.
Backups
Do automated backups exist at all? If so, when was the most recent one taken, and (the question almost nobody can answer) has a restore ever actually been tested? I also check whether backups are stored somewhere other than the same server the site lives on, since a host-level failure can otherwise take out the backup along with the site it was supposed to protect.
Speed
Does the homepage load in under three seconds? I run it through a speed test to see what’s actually holding it back: oversized images are the most common culprit by far, followed by a missing caching plugin and, less often, the hosting plan itself being the bottleneck.
Reliability
Is anything watching for downtime, or would you only find out from a customer? I also test the contact form myself (submitting it and confirming an email actually arrives) because a silently broken contact form is one of the most common things I find, and it can go unnoticed for months since nobody submits their own form to check. And I check the mobile view, since that’s often the majority of your actual traffic and the thing least likely to get double-checked after a change.
Trust signals
The small things that quietly tell a visitor whether a site is being looked after: is the copyright year in the footer current, are there any broken links on the homepage, does the padlock show as secure rather than “not secure”? None of these affect function, but they’re often the first thing a visitor’s eye catches, consciously or not, when deciding whether to trust a business.
Why “3 things” and not a 40-item report
I could hand back the entire checklist with every box checked or unchecked. I don’t, because that’s not actually useful: it’s overwhelming, and most of it isn’t urgent. What’s useful is knowing the three things that matter most right now, in plain English, so you can decide what to do about them, whether that’s fixing them yourself, having someone else do it once, or deciding the whole thing is easier to hand off on an ongoing basis.
If you’ve been wondering what shape your own site is actually in, this is the fastest way to find out.