Full WordPress Security Review
Review the installation, software versions, configuration, Site Health information and other security-relevant areas to identify anything requiring attention.
ONE-OFF WORDPRESS AUDIT
A Complete WordPress Health, Security & Performance Check
Not sure how healthy your WordPress website really is? We will review its security, software, configuration and performance, deal with appropriate issues where we can, safely apply available updates and give you a clear report explaining what we found.
ONE-OFF
£60 + VAT
No subscription. No ongoing commitment. One comprehensive review by the BWF team.
£60 + VAT
No subscription. No ongoing commitment. One comprehensive review by the BWF team.
WORDPRESS · HEALTH CHECK
Website AuditSecurity · Updates · Performance
AUDIT
01Security reviewChecked
02VulnerabilitiesReviewed
03MalwareScanned
04UpdatesChecked
05WebsiteTested
06PerformanceReviewed
WORDPRESS HEALTH CHECK
One audit. A much clearer picture of your WordPress website.
WordPress websites can gradually collect outdated plugins, old themes, unused components, vulnerable software, configuration problems, performance issues and potentially malicious files. A site can still appear to work normally while something underneath needs attention.
The BWF team reviews the website, addresses sensible issues where possible and gives you a straightforward picture of its current condition.
Malware & Compromise Checks
Check for suspicious files, injected code and other indicators using the security tools available within the BWF hosting environment. Where straightforward malware can be safely removed, BWF will attempt to clean it.
Core, Plugin & Theme Updates
Review available updates and apply appropriate ones where they can reasonably and safely be completed. Compatibility matters: unsupported, abandoned or problematic components will be highlighted.
Before & After Testing
Establish a baseline before significant changes, then check important pages and obvious functionality again afterwards. This is a practical health check, not full application QA.
Speed & Performance Advice
Review obvious performance issues and practical opportunities involving caching, plugins, PHP, images, database overhead and front-end loading. Recommendations are based on what is useful for your site.
A Clear Report & Recommendations
Receive a written report covering what we checked, what we found, the work completed, anything left unchanged and sensible next steps—in plain English, with technical detail where useful.
WHAT WE CHECK
More than simply clicking “Update All”
Good WordPress maintenance means understanding the installation, not just looking for red update badges in wp-admin. A BWF team member reviews the areas that make sense for your website and access.
01
WordPress
- WordPress core version and available updates
- Site Health warnings and recommendations
- HTTPS configuration
- Relevant configuration concerns
- Exposed debugging where relevant
- Communication with WordPress services
02
Plugins & Themes
- Active plugin versions and inactive plugins
- Active theme and unused themes
- Outdated, vulnerable, abandoned or unsupported components where identifiable
- Unnecessary software
- Premium components that need a valid licence for updates
03
Security
- Malware and suspicious file indicators
- Unexpected code where identifiable
- WordPress core integrity where appropriate and supported
- Obvious database compromise indicators where appropriate
- Suspicious or unnecessary privileged accounts where identifiable
- Security-related Site Health and filesystem findings
04
Hosting Environment
- PHP version and obvious compatibility concerns
- SSL/HTTPS and relevant WordPress server configuration
- Obvious errors exposed publicly
- Cron, loopback or REST issues identified by Site Health
- Storage or database concerns where relevant
The audit uses legitimate administrative and hosting access. It is not penetration testing, a PCI scan or an intrusive security assessment.
REDUCE THE ATTACK SURFACE
Old software does not stop being a risk just because the website still works
WordPress is flexible because it can use themes and plugins for many jobs. Each extra component is another piece of software to maintain. Over time, a site can collect old plugins, abandoned themes, unsupported software, vulnerable components, unused administrator accounts and unnecessary complexity.
The point is to understand the risks and deal with them sensibly—not to create alarm. The audit looks at the parts that make up your website and explains what should happen next.
WORDPRESS WEBSITETHE PARTS THAT NEED CARE
CORE+THEME+PLUGINS+USERS+PHP+HOSTING
REVIEW EACH LAYERIDENTIFY · UPDATE · TEST · ADVISE
CHECK · INVESTIGATE · CLEAN
If something suspicious is there, we want to know about it
Malware is not always obvious to the website owner. A compromised WordPress installation may still appear to work normally. BWF uses the security visibility available within its hosting environment to investigate relevant signs and report what our checks identify.
If straightforward malware can be safely removed during the audit, we will attempt to clean it. The £60 fee does not include unlimited malware remediation.
POSSIBLE SIGNS TO INVESTIGATE
Unexpected redirectsMalicious JavaScriptSpam pagesUnfamiliar filesNew administrator usersUnusual PHP filesInjected database contentSearch or browser warningsUnusual spam activity
UPDATE WITH CARE
Updates matter. So does making sure the website still works.
Outdated software can create security concerns, but applying a long list of updates blindly can break an older website. BWF takes a considered approach and records what was changed and why anything was left in place.
Understand the site
Review versions, the current website and obvious functionality before significant changes.
Check recovery options
Check relevant backup or recovery availability where applicable before substantial changes.
Apply suitable updates
Update WordPress, plugins and themes where the change can reasonably and safely be completed.
Check the result
Recheck important pages and obvious functionality after the audit work.
Explain what happened
Record updates completed and highlight anything deliberately left unchanged and why.
Recovery and rollback options depend on what is available for the particular website and hosting environment.
BEFORE & AFTER TESTING
We check the website before we change it, and again when we’re finished
The audit is practical work, not just a list of recommendations. Where BWF makes updates or other changes, we carry out basic checks before and afterwards so obvious problems can be investigated.
Understand how it behaves now
- Homepage and selected important pages
- Navigation and responsive presentation
- Forms and obvious site functions where practical
- WordPress login/admin access
- Key features that are apparent from the site
Check again after audit work
- Revisit the same important pages
- Check obvious front-end errors
- Recheck forms or key functions where practical
- Note anything that needs further attention
- Record the checks in your report
This is not full application QA, bespoke development testing or ecommerce transaction testing. Where relevant, basic WooCommerce storefront or cart checks may be included.
PERFORMANCE MATTERS TOO
Security is only part of a healthy WordPress website
BWF also reviews obvious performance problems and points out practical opportunities to improve the experience. Where useful, suitable performance tools and measurements can help inform the recommendations.
Small, low-risk improvements may be made where practical. Larger optimisation, development or redesign work is recommended separately.
PERFORMANCE REVIEWOBSERVATIONS
01
CachingPage, browser and object caching where relevant
02
WordPress componentsPlugin load, scripts and unnecessary assets
03
Hosting environmentPHP, database and LiteSpeed options where supported
04
Front-end deliveryImages, third-party scripts and meaningful Core Web Vitals or PageSpeed observations
A basic review, not a guaranteed PageSpeed score.
YOUR AUDIT REPORT
Know exactly what we found
You receive a written report covering security concerns and malware findings, vulnerable or outdated components, updates completed or deferred, testing performed, performance observations, improvements made and recommended next steps.
It is prepared by the BWF team to be useful to a business owner as well as a technical customer—not just a computer-generated scan result.
WHAT WE FOUNDWHAT WE FIXEDWHAT NEEDS ATTENTIONWHAT WE RECOMMEND
Overall Website HealthReview complete
SecurityNeeds attention
MalwareNo active threat found*
WordPress coreUpdated*
Plugins2 need attention*
ThemeCurrent*
Site Health3 recommendations*
PerformanceImprovements available*
*Example wording only. These are not findings about your website.
A CLEARER PICTURE OF YOUR SITE
When is a WordPress audit a good idea?
An Older WordPress Website
Your site has been running for years and you’re not sure when it was last properly reviewed.
Lots of Updates Waiting
WordPress has a long update list and you don’t want to simply click “Update All”.
A Website You’ve Inherited
Someone else built or managed the site and you’d like to understand its current condition.
After a Security Concern
You’ve noticed unusual behaviour or want the website investigated by a hosting team.
A Slow WordPress Website
The site works, but performance has changed and you’d like practical advice.
Before Bigger Changes
Get a clearer picture of the existing website before deciding what to invest in next.
ONE REVIEW · ONE REPORT
Everything included for one £60 + VAT fee
A BWF team member reviews the website, completes appropriate work where possible and reports back clearly.
WordPress Audit
- WordPress core review
- Plugin and theme review
- Site Health review
- Environment and configuration checks
- Vulnerability and relevant user review
Security & Malware
- Malware investigation
- Suspicious file and compromise checks
- Security configuration observations
- Straightforward clean-up where possible
- Security recommendations
Updates & Testing
- Appropriate core, plugin and theme updates
- Baseline and post-update checks
- Compatibility concerns highlighted
- Testing of important pages and obvious functionality
- Changes recorded in the report
Performance & Advice
- Basic performance review
- Caching and plugin observations
- PHP and environment observations
- Practical improvement suggestions
- Written final report and next steps
SIMPLE ONE-OFF PRICE
One website. One audit. £60 + VAT.
No contract and no recurring subscription. We review the WordPress website, complete the agreed audit work and provide our findings and recommendations.
When opening your ticket, tell us the domain name you would like us to audit.
ONE-OFF
£60 + VAT
One website · One point-in-time review
Request Your WordPress Audit
No subscription. No ongoing commitment.
£60 + VAT
One website · One point-in-time review
Request Your WordPress Audit
No subscription. No ongoing commitment.
WHAT HAPPENS AFTER THE AUDIT?
Want us to keep looking after WordPress?
The £60 audit is a point-in-time review. It does not include ongoing monitoring, future plugin updates, ongoing malware protection or recurring management.
Our WordPress Management Service is for clients who would rather have BWF continue looking after updates, security, backups and WordPress health. It includes the ongoing tools and management described on that page; the one-off audit does not add or start those services.
For context, WP Umbrella supports updates, backups and monitoring within the ongoing management service.
CLEAR SCOPE · PRACTICAL ADVICE
A thorough health check, not an impossible guarantee
This is a point-in-time review using the access and tools available to BWF. It cannot prove that a website has never been compromised or guarantee it will not be compromised in future. Malware can sometimes be deeply embedded or deliberately hidden, and BWF will report what our checks identify.
Some updates cannot safely be completed when software is abandoned, incompatible or needs a valid third-party licence. Significant development work and extensive malware remediation are outside the one-off audit. If anything needs additional work, BWF will explain the options and discuss any extra charge before proceeding.
Server-level protection is a separate service. See OPSSHIELD Security Suite for details; it is not included in the £60 WordPress audit.
FREQUENTLY ASKED QUESTIONS
The details, made simple
What does the WordPress Audit cost?
£60 + VAT for one WordPress website. It is a single one-off service with no recurring subscription.
What do you actually check?
We review security, WordPress core, plugins, themes, identifiable vulnerabilities, malware indicators, Site Health, PHP and hosting environment, relevant users, available updates, important website functions and basic performance.
Will you update WordPress for me?
Yes, where BWF believes an available update can reasonably and safely be completed. If there is a compatibility concern, a missing licence or a material risk, we may leave it unchanged and explain why in the report.
Do you update plugins and themes too?
Yes, where appropriate and possible. Some premium plugins and themes need an active licence to download updates. BWF cannot supply third-party premium licences as part of the audit.
What happens if an update breaks something?
We carry out baseline checks before substantial changes and recheck the website afterwards. If an update causes an obvious problem, BWF will investigate the recovery options available for that particular site. Any backup or rollback depends on what is actually available.
Do you scan for malware?
Yes. BWF checks for malware and other indicators of compromise using the security tools and access available to us in the hosting environment.
Is malware clean-up included?
Straightforward malware that can reasonably and safely be cleaned during the audit will be addressed where possible. Extensive manual remediation, forensic investigation, redevelopment or complex database cleaning may need additional work. BWF will discuss this with you first.
Does this guarantee my website is malware free?
No. The audit is a thorough point-in-time review using the tools and access available to BWF, but sophisticated or hidden malware can evade detection.
Does this guarantee my website cannot be hacked?
No. Current software, secure access and suitable controls can reduce risk, but no website can be guaranteed immune from compromise.
Will you check website speed?
Yes. The audit includes a basic performance review and recommendations, which may cover caching, plugins, images, PHP, database considerations and front-end performance. It does not include extensive redevelopment or a guaranteed PageSpeed score.
Will you make performance improvements?
Where straightforward, low-risk improvements can reasonably be made during the audit, BWF can assist. Larger development, redesign or optimisation projects will be recommended separately.
Does this include a website redesign?
No. This is a technical WordPress health, security and performance audit. Website redesign, content entry and substantial development work are separate services.
What if my WordPress installation is very old?
An audit can be especially useful for an older installation. Some themes and plugins may not support current WordPress or PHP versions. If updating blindly could break the website, BWF will explain the issue and recommend the safest next step.
Is this the same as your WordPress Management Service?
No. The £60 audit is a one-off review. WordPress Management is a separate ongoing service for continued updates, security, backups and management.
Is this a penetration test?
No. It is a WordPress health and security audit performed with legitimate website and hosting access. It is not a penetration test, PCI scan or adversarial security assessment.
How do I order an audit?
Open a BWF support ticket and tell us the domain name of the WordPress website you would like audited. BWF can confirm the website details and arrange the audit.
WORDPRESS HEALTH CHECK
Find out what is really happening under the hood
Security, malware, updates, testing and performance reviewed by the BWF team, with a clear report explaining what we found and what we recommend next.
ONE-OFF
£60 + VAT
No subscription. No ongoing commitment.
£60 + VAT
No subscription. No ongoing commitment.