Repère Security Guides WordPress security
WordPress security: plugins, themes and accounts, what an audit examines
A WordPress site is assembled from code written elsewhere. That is what makes it practical, and it is what moves an audit's work to three specific places: what the site loads, who can get in, and what it lets you see.
A site of assembled parts
On a custom-built site, examining security largely means examining what a team wrote. On a WordPress site it is different: the core comes from the WordPress project, the theme from an author, and each feature from a plugin published by someone else again.
A small-business site commonly assembles twenty or so components from different sources. Each has its own vendor, its own release rhythm, its own history of patches, and sometimes nobody left behind it.
That is not a flaw in WordPress: it is the model, and it is what lets a small company have a serious website without a technical team. But it moves the question. An audit does not only ask “is this code well written?”. It asks first “what is actually in place, and in what condition?”
Plugins and themes
This is the first area of work, and usually the fullest. Four things get examined.
What is installed but inactive
The WordPress documentation is direct on this point: a plugin or theme you do not use should be deleted, not merely deactivated. The code stays on the server until it is removed.
In practice this is the most frequent finding and the simplest to fix. Nobody ever deletes anything, for fear of needing it later.
What is no longer maintained
A component whose vendor has stopped publishing will not receive another patch, however diligently you update. The official WordPress directory flags plugins that have not been tested with recent versions. That is an indicator rather than proof, but it deserves a look.
The versions in place
An audit cross-references every component and its version against published vulnerabilities. It is methodical work rather than clever work, and it is precisely what an owner cannot do alone: it needs a current source and the ability to read it.
Themes, often forgotten
A theme is code just as much as a plugin is. Installations frequently carry several: the one in use, the one before it, and a default theme. A child theme poorly separated from its parent also complicates updates, which ends up getting them postponed.
Accounts and access
The second area is not about surface but about identity, and it is handled differently.
Who can get in
The user list tells the story of the site: the agency from the rebuild, the freelancer from a project, the former marketing employee. Closing an account is nobody's responsibility in particular, so it does not happen.
An audit looks at the accounts themselves, but also at what each one can do. When everyone is an administrator, a mistake by anyone becomes a serious mistake.
How people get in
The Canadian Centre for Cyber Security places strong authentication among the first four measures a small business should put in place. On WordPress, two-factor authentication comes through an extra component, which has a consequence worth noting: that component is part of the surface too, and it gets examined like the others.
What happens around it
Access to the site is not the only access that counts. Access to the hosting, to the database and to the domain registrar opens paths that are at least as direct, and they are reviewed even more rarely.
What the site lets you see
The third area covers what answers when nothing required it to: files left reachable, directories that list themselves, backups dropped at the root during a migration and never removed, version information shown for no reason.
Taken on its own, none of these exposures is dramatic. Their significance is cumulative: they tell you what is running and which versions, which turns a search into a verification.
Security headers belong here too, the instructions a server sends the browser to limit certain kinds of abuse. Their absence is not a vulnerability in itself. It is a protection nobody switched on, when it was free.
What maintenance does not cover
Worth remembering
Keeping a site current and examining what it exposes are two distinct pieces of work. A perfectly maintained site can carry a forgotten administration account, an access rule that is too broad, or a reachable backup. No update fixes any of that, because it is not what an update looks at.
The reverse holds too. An audit records a state on a date; six months later the components will have moved. The two complement each other, and many small businesses need both.
At Repère they are two services: the audit belongs to Repère Security, maintenance to Repère Maintenance. Two mandates, two deliverables, and you are never obliged to take both.
If you would rather look for yourself first, nine checks need no tools and no provider.