A business website is more than an online brochure. It may collect enquiries, process orders, store customer information, connect to business systems, and represent your brand around the clock. If it becomes unavailable, compromised, or unreliable, the impact can extend well beyond a technical inconvenience.
The difficult part is that many website problems are not obvious. A site can look perfectly normal while running outdated software, relying on an untested backup, exposing unnecessary access points, or loading so slowly that potential customers leave before contacting the business.
A website security audit is a structured way to identify these weaknesses, understand their business impact, and decide what to fix first. It should examine more than malware: access controls, software updates, backups, integrations, performance, and the processes used to maintain the site all matter.
This checklist is designed for business owners, marketing teams, and website managers who want a practical starting point.
What is a website security audit?
A website security audit is a review of a website's technical configuration, software, access permissions, and operational practices to identify security risks and reliability problems.
The depth of the review depends on the website. A simple brochure site has different risks from a WooCommerce store, membership platform, booking system, or custom web application. A useful audit starts by understanding what the website does, what data it handles, and which systems it depends on.
A standard review may include:
- Software and dependency updates
- Administrator accounts and permissions
- Plugin, theme, and extension risk
- HTTPS and security configuration
- Backups and recovery testing
- Forms, integrations, and exposed credentials
- Malware indicators and suspicious changes
- Performance and availability
- Error logs and monitoring
- A prioritized remediation plan
An audit is not a guarantee that a website is invulnerable. Its purpose is to reduce avoidable risk, expose weaknesses, and give the business a clear plan for improvement.
The 12-point website security audit checklist
1. Inventory the website's software and dependencies
Start by identifying the content management system, framework, server-side runtime, themes, plugins, libraries, and third-party services the website uses.
This inventory matters because an old component may remain installed even when nobody remembers why it was added. Unused extensions can increase maintenance overhead and create unnecessary risk.
What to check:
- Record the CMS or framework and its current version.
- Identify unsupported or end-of-life components.
- Review active plugins, themes, packages, and integrations.
- Remove components that are genuinely unnecessary, after checking dependencies.
- Confirm that critical components receive security updates.
Do not update production blindly. Test important changes in a staging environment when possible, and keep a verified recovery path before making high-impact changes.
2. Review administrator accounts and permissions
Every account with elevated access increases the importance of strong authentication and careful permission management. Former employees, old contractors, shared accounts, and unnecessary administrator privileges can quietly remain long after a project has changed hands.
What to check:
- Remove accounts that are no longer required.
- Review administrator and editor permissions.
- Give each person an individual account instead of sharing credentials.
- Use multi-factor authentication where supported, especially for privileged accounts.
- Replace weak or reused passwords and protect recovery methods.
- Review hosting, domain registrar, DNS, database, and deployment access—not just the website dashboard.
Access should follow the principle of least privilege: people and services should have only the permissions needed for their responsibilities.
3. Check plugins, themes, and extensions for avoidable risk
Plugins and extensions add useful functionality, but they also create dependencies that must be maintained. Risk can arise from vulnerable code, abandoned projects, poor configuration, or features that are no longer needed.
For WordPress and WooCommerce websites, review each plugin and theme for its purpose, maintenance status, update availability, and compatibility with the current environment.
What to check:
- Confirm that each extension has a clear business purpose.
- Update supported components after appropriate testing.
- Investigate components that have been abandoned or are no longer supported.
- Remove inactive extensions when they are not needed.
- Check whether premium licenses are active where updates depend on them.
- Review security advisories from trustworthy sources rather than assuming that a plugin is safe because it is popular.
Avoid installing multiple plugins that perform overlapping tasks without a clear reason. More components do not automatically mean a better website.
4. Verify HTTPS and security configuration
HTTPS helps protect data while it travels between a visitor's browser and the website. However, seeing a padlock in the browser does not prove that the entire website is securely configured.
What to check:
- Confirm that the TLS certificate is valid and renews correctly.
- Redirect HTTP traffic to HTTPS where appropriate.
- Fix mixed-content warnings.
- Review cookies and session settings for suitable security attributes.
- Check whether security headers are appropriate for the site's functionality.
- Ensure that administrative interfaces and sensitive endpoints are not unnecessarily exposed.
Security settings should be tested against the website's real requirements. Applying a strict policy without checking integrations can break legitimate functionality, so configuration changes should be deliberate and verified.
5. Confirm that backups can actually restore the website
A backup is valuable only if it is recent, complete, accessible, and restorable. A backup job that reports success but has never been tested may not help during an outage or security incident.
What to check:
- Back up both website files and the database when applicable.
- Define a backup schedule based on how frequently the site changes.
- Keep protected copies separate from the production environment.
- Limit who can access or delete backups.
- Monitor backup failures and storage limits.
- Test restoration in a safe environment and document the process.
For an online store, consider what would happen to orders, customer records, product updates, and transactions created after the last backup. Recovery planning should account for business data, not just website files.
6. Review forms, uploads, and public-facing inputs
Contact forms, search boxes, account registration, file uploads, comments, and checkout fields are common ways visitors interact with a website. Each input should be handled safely and reliably.
What to check:
- Validate and sanitize inputs on the server, not only in the browser.
- Apply appropriate file-type and file-size restrictions to uploads.
- Store uploaded files safely and prevent them from being executed as code.
- Use spam protection proportionate to the risk and user experience.
- Ensure that error messages do not expose sensitive technical details.
- Confirm that forms deliver submissions to the intended destination and that failures are visible to the site owner.
If a form collects personal or payment-related information, review the complete data flow and the systems that receive or store it.
7. Inspect integrations, API keys, and secrets
Modern websites often connect to payment gateways, email platforms, CRMs, analytics tools, shipping providers, inventory systems, and custom APIs. An integration can become a weak point if its credentials are exposed or its permissions are broader than necessary.
What to check:
- Search for secrets accidentally included in public code or repositories.
- Keep private keys and credentials out of client-side JavaScript.
- Store secrets in appropriate server-side configuration or a secrets manager.
- Rotate exposed or unnecessarily long-lived credentials.
- Limit API permissions to what each integration actually needs.
- Remove old webhooks, tokens, and integrations that are no longer used.
- Check integration logs for repeated failures or unexpected activity.
If a credential may have been exposed, simply hiding it is not enough. Revoke or rotate it, then investigate whether it was used improperly.
8. Look for signs of compromise and unexpected changes
A compromised website does not always display an obvious warning. Suspicious redirects, unfamiliar administrator accounts, injected pages, unexpected scripts, and unexplained changes to files can all deserve investigation.
What to check:
- Review recent administrator logins and account changes where logs are available.
- Investigate unfamiliar files, scheduled tasks, redirects, and scripts.
- Check for unexpected changes to critical website files.
- Review hosting, application, and security logs for unusual patterns.
- Use reputable scanning tools as one source of evidence, not as proof that the site is clean.
- Compare suspicious changes with legitimate deployments and updates before removing anything.
If you suspect an active compromise, preserve relevant logs and evidence, limit further damage, and follow a structured incident-response process. Deleting files at random can destroy evidence or leave the original access path open.
9. Check server, hosting, and environment configuration
Website security is not limited to the CMS dashboard. Hosting accounts, databases, file permissions, server software, DNS settings, and deployment processes can all affect the site's risk.
What to check:
- Confirm that the server operating system and relevant software are supported.
- Disable services and interfaces that are not required.
- Restrict database access to trusted systems where feasible.
- Review file and directory permissions.
- Prevent debug output and detailed error traces from appearing publicly in production.
- Protect environment files and configuration backups.
- Check domain registrar and DNS account security.
- Separate development, staging, and production environments where practical.
The correct configuration depends on the hosting architecture. Changes to server settings should be made by someone who understands the environment and can verify that the site continues to work.
10. Measure performance on real user journeys
Security and performance are different disciplines, but both affect whether a website remains useful to customers. A slow product page, broken checkout, or unreliable enquiry form can cost business even when no attack has occurred.
Do not judge performance only by the homepage or a single laboratory score. Test the pages and actions that matter to the business.
What to check:
- Measure important pages on mobile and desktop.
- Review image sizes, caching, JavaScript, CSS, and server response times.
- Test navigation, search, login, forms, and checkout where applicable.
- Look for layout shifts or delayed interactions that make the site difficult to use.
- Monitor availability and recurring errors.
- Use real-user data when available, alongside controlled tests.
Google's Core Web Vitals provide useful measures of loading, responsiveness, and visual stability. They are diagnostic signals, not a guarantee of search rankings. Improvements should make the experience better for actual visitors, not merely chase a perfect score.
11. Review monitoring, alerts, and recovery responsibilities
An issue that goes unnoticed for days can become more expensive to fix. Monitoring helps teams detect downtime, failed forms, unusual errors, certificate problems, and other operational issues before they cause prolonged disruption.
What to check:
- Monitor uptime and important customer-facing journeys.
- Alert the right person when backups fail or certificates approach expiry.
- Review error logs on a regular schedule.
- Track critical updates and unresolved security advisories.
- Document who is responsible for responding to incidents.
- Define how the business will communicate and recover if a critical service fails.
Monitoring should be actionable. A flood of low-value alerts can be as ineffective as having no alerts at all.
12. Turn findings into a prioritized remediation plan
An audit that ends with a long list of problems but no order of operations leaves the business guessing. The final report should explain what was found, why it matters, how confident the reviewer is in the finding, and what should happen next.
A practical way to prioritize findings is to consider:
- Potential impact: Could the issue expose sensitive data, enable unauthorized access, or interrupt a critical service?
- Likelihood and exposure: Is the affected component reachable, exploitable, or actively being targeted?
- Business importance: Does it affect checkout, lead generation, customer accounts, or another essential process?
- Fix complexity: Can the issue be resolved safely with a small change, or does it require testing and a planned deployment?
A useful report separates urgent risks from important maintenance and lower-priority improvements. It should also record what was tested and what was outside the scope of the review.
Website security and SEO: why they should be reviewed together
Security, technical reliability, and search visibility are not interchangeable, and a security audit alone will not improve rankings automatically. However, they can overlap in important ways.
A compromised website may be used for spam or unwanted redirects. Broken pages, repeated server errors, and poor mobile usability can frustrate visitors and interfere with a site's ability to serve its purpose. Slow pages may also make key conversion journeys less effective.
A sensible technical review should therefore consider both risk and usability:
- Security: Are access controls, software, and configurations maintained appropriately?
- Reliability: Can visitors access the pages and features they need?
- Performance: Do important pages load and respond well?
- Search accessibility: Can search engines discover and understand the intended content?
- Conversions: Can a visitor complete the action that matters, such as sending an enquiry or placing an order?
Google recommends creating helpful, reliable, people-first content and providing a good overall page experience. No audit, plugin, or agency can guarantee a specific Google ranking. The goal is to remove avoidable technical problems while making the website more useful to people.
How often should a website be audited?
There is no single schedule that fits every website. The right frequency depends on how complex the site is, how often it changes, what information it handles, and how costly downtime would be.
As a starting point:
- Routine maintenance: Review updates, backups, uptime, and critical errors on an ongoing schedule.
- Periodic review: Revisit accounts, extensions, integrations, and configuration regularly.
- After major changes: Review relevant risks after a redesign, migration, new integration, or significant deployment.
- After a security alert or suspicious event: Investigate promptly rather than waiting for the next scheduled audit.
- For high-impact systems: Consider a more formal review process based on business risk and applicable obligations.
A small informational website and a busy e-commerce store should not necessarily follow the same process. The maintenance plan should reflect the site's actual role in the business.
Common website maintenance mistakes to avoid
Even teams with good intentions can leave avoidable gaps. Watch out for these patterns:
- Updating without a recovery plan. Keep a verified backup and test important changes.
- Assuming a security plugin solves everything. Tools can help, but they do not replace secure configuration, access management, and maintenance.
- Keeping unused extensions indefinitely. Review whether each component is still needed.
- Treating a successful scan as a clean bill of health. Automated scans have limits and may miss business-logic or configuration issues.
- Ignoring the hosting and domain accounts. A secure website dashboard cannot compensate for a poorly protected hosting or DNS account.
- Focusing only on the homepage. Test the checkout, login, forms, and other critical journeys too.
- Making changes without documenting them. A record of changes makes troubleshooting and incident response easier.
When should you bring in a website specialist?
A business may be able to handle routine updates internally. Specialist support becomes more valuable when the site has custom code, e-commerce functionality, business-critical integrations, recurring technical failures, or signs of compromise.
Consider getting a professional review if:
- You are unsure whether the site is running supported software.
- Updates repeatedly break important features.
- You cannot confirm that backups can be restored.
- You see unfamiliar accounts, redirects, scripts, or files.
- Your website is slow or unreliable despite basic optimization.
- Forms, payments, or integrations fail intermittently.
- You need a prioritized plan but do not have the internal expertise to assess the risks.
The best support is specific and transparent: it should explain the findings in plain language, distinguish verified issues from possibilities, agree on priorities, and document the work performed.
How Backendly can help
A website should support your business—not become a recurring source of uncertainty. Backendly can be your starting point for discussing website development, technical troubleshooting, maintenance, performance improvements, and integrations suited to your requirements.
If your website has become difficult to maintain, is experiencing recurring errors, or needs a structured technical review, describe the problem and the outcome you need. Include your website URL, the symptoms you have noticed, when the issue began, and any relevant error messages. Do not send passwords, private keys, or other secrets in an initial enquiry.
Visit Backendly to discuss your website requirements and identify practical next steps.
Frequently asked questions
What is included in a website security audit?
The scope varies, but it commonly includes software and dependency reviews, account permissions, configuration, backups, exposed secrets, public-facing inputs, logs, and a prioritized list of findings. A deeper penetration test is a separate engagement and should have explicit authorization and scope.
Can a website be hacked even if it uses HTTPS?
Yes. HTTPS helps protect data in transit, but it does not fix vulnerable plugins, weak passwords, insecure application logic, compromised hosting accounts, or unsafe server configuration.
Does updating WordPress plugins guarantee website security?
No. Updates can fix known vulnerabilities, but security also depends on configuration, access controls, hosting, backups, custom code, and the way the website is operated. Updates should be applied and tested as part of a broader maintenance process.
Does website security affect SEO?
Security and SEO are not the same thing, and a security audit does not guarantee higher rankings. However, compromise, spam injection, unwanted redirects, broken pages, and reliability problems can damage user trust and interfere with a site's normal operation. Technical health should be considered alongside content quality and search accessibility.
How long does a website security audit take?
It depends on the site's size, complexity, integrations, access available, and depth of testing. A small brochure site may require a very different effort from a large WooCommerce store or custom web application. The scope should be agreed before work begins.
What should I do if I think my website has been compromised?
Use a structured incident-response process: protect affected systems, preserve relevant logs, assess the extent of the compromise, remove the cause rather than only the visible symptoms, rotate exposed credentials, restore from a trusted source if necessary, and verify the site before returning it to normal operation. For a business-critical site, involve qualified support promptly.
Further reading
- Google Search Central: Creating helpful, reliable, people-first content
- Google Search Central: SEO Starter Guide
- Google Search Central: Understanding Core Web Vitals
- OWASP Top 10
Need help with a website issue? Visit backend.ly and explain what you need to fix, improve, or build.
