WordPress Security Audit
WordPress experts since 2017
WordPress security audit:
know exactly what is exposed ●
Unsure about your site’s security, or need to confirm an intrusion? Our experts examine the files, database, configuration and access rights, then provide you with a clear report and an action plan you can apply today.
Files
Database
Access
External view
4
areas examined
thoroughly
1
clear report,
ready to share as is
12
actions ranked
by risk
€300 excl. VAT
one-off audit,
single payment
74 reviews
What we analyze
A complete analysis, from your files to your public exposure
Four areas are examined, where vulnerabilities and traces of an intrusion are hidden.
The files
Every PHP file present on the disk is read, including copies of third-party libraries.
The database
Options, scheduled tasks, stored code snippets, and user accounts.
Access
Login history and past analyses. Each account is compared against the permissions it actually has.
The outside
What a stranger can access from the Internet. Every sensitive address is actually tested.
Good to know
An audit is not only for hacked sites
Most findings are exposures, not intrusions: files accessible without logging in, ineffective protection rules, credentials that remained active after a plugin was removed.
Without logging in
Without hacking
Visible from the Internet
Our pricing
Security audit of your WordPress site
Clear pricing so you know where you stand. Add cleanup, a firewall or maintenance support if needed.
The deliverable
A report that starts with the answer
No dashboard to decipher: one sentence summarizes the security status of your site, then each finding is detailed and explained.
Overview
- Severity of findings at a glance
- Inventory of everything that was examined
- Actual state of the site on the report date
Reconstruction of the facts
- Dated timeline of events
- Reconstructed from connection logs
- Grey areas are flagged
Readable findings
- Complete sentences, not CVE numbers
- Impact, location, cost and action
- Understandable for your client
Exposed paths
- Every public address is actually tested
- Configuration, backups, logs, documents
- An actionable checklist
What is ruled out
- Successful checks are stated
- The scope of the analysis is explicit
- Indicators to block and search for
Prioritized action plan
- Ranked by risk avoided, not by severity
- A person responsible for each step
- First actions to take the same day
After the audit
An action plan ranked by risk avoided
In the order that reduces risk the most, with a person responsible for each step. The first 4 are handled the same day. Examples taken from a sample report.
Delete the exposed configuration copy
You: then rotate the database password, authentication keys, and exposed API keys.
Close public access to customer documents
Your hosting provider: server-side blocking, then delivery via a script that verifies identity.
Block PHP execution in media
Your hosting provider: a single server rule, the most cost-effective change.
Identify unknown admin sessions
Your agency: trace the source, then close all open sessions.
Our method
Why an audit rather than an anti-malware scan
A scanner recognizes known files. An audit reconstructs what happened and checks what an unknown party can actually access.
A clean scan does not prove that a site is healthy: it only detects what it knows.
| Criterion | ANTI-MALWARE SCAN | SECURITY AUDIT |
|---|---|---|
| ScopeWhat is analyzed | Known files | Files, database, access, external |
| Dated intrusionReconstructed from connection logs | No | Yes |
| Exposed pathsActually tested from the Internet | No | Yes |
| PersistenceSearched for in the database | No | Yes |
| ResultWhat you receive | List of alerts | Prioritized action plan |
| DeliverableReadable by a non-technical person | Raw alerts | Shareable report |
The events are reconstructed
Login logs and scan history make it possible to date the intrusion. An alert that was left unresolved is found and reported.
What is sound is stated
Successful checks are included in the report, so you know what has been ruled out.
Exposures without malware
Accessible configuration file, public client documents: a scanner reports nothing, the audit tests each sensitive address.
Scanning, for monitoring
It detects what it knows, continuously. The audit complements it; it does not replace it.
The audit, for a clear view
After an incident, before a relaunch or redesign, or to reassure a client: a dated and well-supported assessment.
Testimonials
Discover our clients’ reviews
They trust us with the maintenance and security of their WordPress site.
Need answers?
Your questions about the WordPress security audit
Do you need to have been hacked to order an audit?
No. The audit is also intended for healthy sites: it shows what an unknown person can access today, without any intrusion having taken place.
Will the report be understandable for my client?
Yes. Each finding is written in full sentences that describe the consequences, technical terms are explained throughout the text, and the report prints cleanly. You can send it as is.
Is this the same thing as an anti-malware scan?
No. A scanner lists known files. The audit reconstructs the timeline from the logs, tests what is accessible from the Internet, and looks for backdoors in the database.
What happens after the report is delivered?
Nothing is mandatory. The report stands on its own, with an action plan that you or your agency can apply. If you prefer to delegate, we can carry out the cleanup and secure your site.
What should you do if the audit reveals a hack?
Our cleanup and security intervention removes malware, restores a healthy version, and fixes the original vulnerability, with a 60-day guarantee. It is included from the Business package onward, and billed at €290 excl. VAT for the Pro package or as a one-off intervention.
Ready to get a clear picture?
Order your security audit or ask us your questions. Our team of WordPress experts will reply within 24 hours.
Julien Guiard
CEO & Founder
A WordPress expert since 2017, I am your dedicated point of contact.
Contact Julien directly
Phone
Video appointment
Response guaranteed within 24 hours
Contact us
Do you have a question about the security audit or our offers?
Fill out the form below and we will get back to you quickly.
Contact
"*" indicates required fields