What a WordPress Security Audit Actually Checks For
A "WordPress security audit" can mean genuinely different things depending on who's performing it and what tools they're using, ranging from a superficial, largely automated scan to a genuinely thorough manual review — understanding what a proper, comprehensive audit actually examines helps distinguish a meaningful security assessment from a shallow one that mostly just runs an automated scanner and reports whatever it happened to flag.
Plugin and Theme Vulnerability Scanning
A foundational, largely automatable component checks every installed plugin and theme's specific version against known, publicly disclosed vulnerability databases — since outdated plugins with known, unpatched vulnerabilities remain one of the single largest sources of WordPress compromises industry-wide. A thorough audit doesn't stop at simply checking version numbers against a database, though — it also considers whether a plugin is actively maintained at all (a plugin abandoned by its developer, even if its current version has no currently known vulnerability, represents an accumulating future risk with no prospect of a patch if one is discovered later) and whether the specific combination of installed plugins might interact in unexpected, security-relevant ways.
User Account and Permission Review
A genuinely thorough audit reviews every user account with access to the site, checking for accounts that should no longer exist (a former employee or contractor whose access was never formally revoked), accounts with more privilege than their actual role requires (a content editor with full administrator access when editor-level permissions would suffice), and accounts lacking two-factor authentication despite holding administrative privileges — since even a technically secure, fully patched installation remains vulnerable if account access itself is poorly managed and overly permissive.
File Integrity and Malware Scanning
This component compares the site's actual core WordPress files, and ideally plugin and theme files as well, against known-good, official versions, specifically looking for unauthorized modifications that might indicate an existing compromise — a webshell or backdoor planted during a previous, possibly still-undetected breach, discussed further in the piece on why malware removal services sometimes miss backdoors elsewhere on this blog. This scanning needs to go beyond simply checking for known malware signatures, since a sophisticated compromise may not match any previously catalogued pattern at all, requiring genuine file-integrity comparison against a trusted baseline rather than pure signature matching.
Configuration and Hardening Review
Beyond vulnerabilities in specific software components, a thorough audit examines the broader server and application configuration for hardening opportunities: whether file permissions are set appropriately restrictively rather than overly permissive by default, whether sensitive configuration files (like wp-config.php) are protected from direct web access, whether database credentials follow the principle of least privilege rather than using an overly powerful database account for routine application operations, and whether basic protective measures like rate limiting on the login page (discussed elsewhere on this blog) and a properly configured firewall are actually in place.
Backup and Recovery Readiness Assessment
A comprehensive audit also examines whether a genuine, tested backup and recovery capability actually exists — not merely whether backups are scheduled to run, but whether they've actually been verified through a real restore test (discussed in depth elsewhere on this blog), since a security incident's ultimate severity often depends heavily on how quickly and confidently a clean, verified restore can be performed afterward, regardless of how the initial compromise occurred.
What a Shallow, Purely Automated Scan Typically Misses
A purely automated vulnerability scan, while a genuinely useful and often necessary component, has real limitations a thorough audit should account for: it generally can't assess whether user permissions are appropriately scoped, can't evaluate custom code for logic flaws specific to that site's own development, and can't necessarily distinguish a sophisticated, custom-tailored backdoor from legitimate site functionality without genuine manual review by someone who understands what normal, expected file and code patterns actually look like for that specific site.
How to Evaluate Whether a Security Audit Offering Is Actually Thorough
When evaluating a security audit service or deciding how much scrutiny to apply to a self-performed review, it's worth checking whether the process covers all of the categories described above, or whether it's effectively limited to running an automated scanner and reporting its output — the latter still provides real value, but represents a meaningfully narrower, more superficial assessment than the phrase "security audit" might suggest to someone expecting a genuinely comprehensive review.
The Takeaway
A genuinely thorough WordPress security audit spans plugin and theme vulnerability scanning, user account and permission review, file integrity checking for existing compromise, configuration hardening assessment, and backup readiness verification — considerably more than the automated vulnerability scan that some services market under the same "security audit" label, and worth explicitly distinguishing between the two when deciding how much confidence a specific audit's clean bill of health actually warrants.
Tags: security audit, vulnerability assessment, WordPress security