WordPress Security Audit Scorecard
Website: ___________________________ | Audit date: ___________________________ | Carried out by: ___________________________
Use this scorecard to assess the security status of your WordPress website. Award points per category and add them up at the end. That way you can see immediately where action is needed.
Scoring scheme
| Score | Status | Description |
|---|---|---|
| 2 points | ✓ Fully implemented | All requirements met |
| 1 point | ◐ Partially implemented | Some requirements met, room for improvement |
| 0 points | ✗ Not implemented | Requirements not met, immediate action needed |
1. WordPress Core & Updates (max. 10 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| WordPress Core on the latest version | ______ | |
| Automatic updates for minor versions enabled | ______ | |
| All installed plugins up to date | ______ | |
| All themes up to date (including inactive ones) | ______ | |
| Unused plugins and themes completely removed | ______ | |
| Subtotal category 1: | ______ / 10 |
2. Users & access management (max. 12 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| No users with the default username „admin“ | ______ | |
| All users use strong, unique passwords | ______ | |
| Two-factor authentication (2FA) active for admin accounts | ______ | |
| Login attempts limited (e.g. max. 5 attempts) | ______ | |
| User roles correctly assigned (principle of least privilege) | ______ | |
| Inactive and invalid user accounts removed | ______ | |
| Subtotal category 2: | ______ / 12 |
3. File & server configuration (max. 12 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| File permissions set correctly (folders: 755, files: 644) | ______ | |
| wp-config.php outside the webroot or protected | ______ | |
| Directory listing disabled (.htaccess or server configuration) | ______ | |
| Security keys and salts in wp-config.php current and unique | ______ | |
| Debug mode (WP_DEBUG) disabled in the production environment | ______ | |
| PHP version current and vendor-supported (at least 8.0+) | ______ | |
| Subtotal category 3: | ______ / 12 |
4. SSL/TLS & encryption (max. 8 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| Valid SSL certificate installed and active | ______ | |
| HTTPS redirect enabled (HTTP → HTTPS) | ______ | |
| HSTS (HTTP Strict Transport Security) enabled | ______ | |
| TLS 1.2 or higher used, outdated protocols disabled | ______ | |
| Subtotal category 4: | ______ / 8 |
5. Backup & disaster recovery (max. 8 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| Regular automated backups active (at least weekly) | ______ | |
| Backups secured at an external location (off-site) | ______ | |
| Backup restore tested and documented | ______ | |
| Database backups included and encrypted | ______ | |
| Subtotal category 5: | ______ / 8 |
6. Firewall & malware protection (max. 10 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| Web Application Firewall (WAF) active (e.g. Cloudflare, Sucuri, Wordfence) | ______ | |
| Malware scanner run regularly (at least weekly) | ______ | |
| Security plugin installed and configured | ______ | |
| IP blocking for known attackers enabled | ______ | |
| Brute-force protection active (rate limiting, CAPTCHA) | ______ | |
| Subtotal category 6: | ______ / 10 |
7. Database security (max. 8 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| Database prefix changed (not the default „wp_“) | ______ | |
| Database user with minimal privileges (no root user) | ______ | |
| Database reachable only from localhost or defined IPs | ______ | |
| Database optimised and cleaned up regularly | ______ | |
| Subtotal category 7: | ______ / 8 |
8. Monitoring & logging (max. 8 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| Activity logs active and reviewed regularly | ______ | |
| Uptime monitoring set up (e.g. UptimeRobot, Pingdom) | ______ | |
| Security alerts and notifications configured | ______ | |
| Analysis of suspicious traffic and login attempts | ______ | |
| Subtotal category 8: | ______ / 8 |
9. Plugin & theme security (max. 10 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| Plugins only from trusted sources (WordPress.org, premium developers) | ______ | |
| No known security vulnerabilities in installed plugins | ______ | |
| Theme from a reputable source, updated regularly | ______ | |
| Child theme used (when customising the theme) | ______ | |
| Nulled/pirated software ruled out | ______ | |
| Subtotal category 9: | ______ / 10 |
10. Hosting & server security (max. 8 points)
| Criterion | Points (0-2) | Notes |
|---|---|---|
| Hosting provider with active security measures (firewall, IDS/IPS) | ______ | |
| Server software (Apache/Nginx) up to date | ______ | |
| SFTP/SSH used instead of FTP | ______ | |
| Separate staging environment in place | ______ | |
| Subtotal category 10: | ______ / 8 |
Overall score
| Category | Points achieved | Max. points |
|---|---|---|
| 1. WordPress Core & Updates | ______ | 10 |
| 2. Users & access management | ______ | 12 |
| 3. File & server configuration | ______ | 12 |
| 4. SSL/TLS & encryption | ______ | 8 |
| 5. Backup & disaster recovery | ______ | 8 |
| 6. Firewall & malware protection | ______ | 10 |
| 7. Database security | ______ | 8 |
| 8. Monitoring & logging | ______ | 8 |
| 9. Plugin & theme security | ______ | 10 |
| 10. Hosting & server security | ______ | 8 |
| OVERALL SCORE: | ______ / 94 |
Assessment & recommended action
| Score range | Assessment | Recommended action |
|---|---|---|
| 85–94 points | Excellent | Your WordPress website is very well protected. Carry out regular audits and stay current with updates. |
| 70–84 points | Good | A solid security foundation. Prioritise categories with low scores and close the smaller gaps. |
| 50–69 points | Adequate | Room for improvement. Focus on the critical areas (users, updates, backups, SSL). |
| Under 50 points | Critical | Urgent security measures required! Start with the basics straight away: updates, strong passwords, SSL, backups. Consider professional support. |
Next steps & action plan
Priority 1 (immediately):
- _________________________________________________________________________
- _________________________________________________________________________
Priority 2 (within 1 week):
- _________________________________________________________________________
- _________________________________________________________________________
Priority 3 (within 1 month):
- _________________________________________________________________________
- _________________________________________________________________________
Next audit scheduled for: ___________________________ | Responsible: ___________________________
This scorecard is based on current best practices for WordPress security. I recommend running it quarterly.
Frequently asked questions
What is a WordPress security audit?
A security audit assesses the security status of your WordPress installation. It checks: updates, passwords, backups, firewall, SSL and user roles.
How often should I run a security audit?
Quarterly is the minimum. Monthly is better. After major updates or security incidents: check again straight away.
Which security plugins do you recommend?
Wordfence and Sucuri. Both offer a firewall, malware scanner and login protection. For smaller websites the free version is enough.