Website Security Audit Checklist: What to Check and Why

26 September 2026

A website security audit doesn't need to be complicated to be useful. Most real exposure comes from a small number of things going unchecked for a long time, not from anything exotic. Here's what actually matters, roughly in order of how often it's the actual problem.

1. Is the CMS and its plugins up to date?

An outdated WordPress core, an old theme, or a plugin that hasn't been updated in years is the single most common finding. Each version behind is a version's worth of publicly known vulnerabilities (CVEs) an attacker can look up by name. This is especially true once a platform reaches end-of-life and stops receiving security patches at all.

2. Is the site actually on HTTPS?

A missing or misconfigured HTTPS certificate means data between the visitor and your server isn't encrypted, browsers will actively warn visitors about it, and it's also a basic trust signal both search engines and AI assistants weigh when deciding whether to recommend a site.

3. Are security headers set?

HTTP security headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security and similar) tell the browser how to behave defensively, blocking classes of attack like clickjacking or certain script-injection techniques. Most sites have none of these set, simply because they're not visible to a visitor and easy to forget.

4. Do the individual issues compound?

A single outdated plugin might be low risk on its own. That same plugin combined with an end-of-life PHP version and no security headers is a materially worse position than the sum of its parts, since each individual weakness makes the others more exploitable. A proper audit should flag these combinations specifically, not just list issues in isolation.

5. Who else can access it, and how?

Old admin accounts nobody remembers creating, weak or shared passwords, and no two-factor authentication on the CMS login are all common findings that a purely technical scan can miss, since they're about people and process, not code.

How often should this happen?

Once is a snapshot. Software goes out of date on its own schedule regardless of whether anyone is watching, so a one-off audit answers “how are we today”, not “how are we in six months”. Scheduled rescans catch drift before it becomes a real gap.