Repère Security WordPress audit
Auditing a WordPress site, without confusing it with maintaining one
Two real needs, two distinct mandates. Maintenance keeps the site current over time. An audit measures, on a date and within a signed scope, what the site exposes.
A site made of code you did not write
That is the strength of WordPress: you assemble a site from existing components instead of building everything. A plugin for forms, another for the store, a purchased theme, sometimes thirty parts in total.
It is also what changes the work of an audit. On a custom site, you examine what a team wrote. On a WordPress site, most of the surface comes from outside: every component has its own vendor, its own release rhythm, its own history of patches, and sometimes nobody left to maintain it.
The WordPress documentation recommends removing unused plugins and themes outright rather than leaving them deactivated. An audit often starts there: establishing what is actually in place.
Auditing and maintaining
Both are useful, and many small businesses need both. They are two separate mandates, with two deliverables.
| Auditing | Maintaining | |
|---|---|---|
| The question | What does this site expose today? | How do we keep it current over time? |
| The rhythm | One-time, on a date | Ongoing, every month |
| The frame | A signed scope, with its exclusions | A plan with included time |
| The deliverable | Ranked findings and a remediation for each | A current site and a record of what was done |
| At Repère | Repère Security | Repère Maintenance |
A perfectly maintained site can still carry a weakness no update fixes: an admin account left open, an access rule that is too broad, a form that passes on more than intended. Maintenance will not see it, because that is not what it looks at.
The reverse is also true: an audit does not replace maintenance. It records a state on a date; six months later, the components will have moved.
What the audit examines on a WordPress site
The six families of checks apply to any site. Three of them take a particular shape here.
-
Components and their versions
The core, the theme, the active plugins and the dormant ones. What is publicly exposed, what has been abandoned by its vendor, and what carries known vulnerabilities.
-
Accounts and roles
Who has administrator access, since when, and who should no longer have it. This is where a former contractor's access turns up.
-
What the site lets you see
Configuration files, directories, forgotten backups, version information shown for no reason.
What each family covers in detail is set out in the guide: WordPress security, what an audit examines.
When a WordPress audit becomes worthwhile
Not every site needs one at the same moment. These are the situations that, in practice, justify going and looking.
- Nobody knows everything that is installed
The site changed hands, or grew by successive additions. You open the plugin list and do not recognize half of it.
- Components have piled up
Every need brought its plugin, and nothing was ever removed. What is deactivated stays installed, and what is no longer maintained stays in place.
- Former contractors had access
An agency, a freelancer, an employee who left. Closing an account is nobody's job in particular, so it does not get done.
- The site has just changed shape
A redesign, a hosting migration, a new store or client area. What was true before is not necessarily true after.
- The site handles data that matters
Customer accounts, payments, files, forms that collect more than a name and an email. What the site collects determines what has to be checked.
- The origin of a component is no longer clear
A theme bought on a marketplace, a plugin installed from a file rather than the official directory, custom work whose author can no longer be reached.
- Someone asks where you stand
A prime contractor, a client larger than you, an insurer. More and more of them want a written assessment before signing.
Conversely, a few-page brochure site that is kept current, with no form beyond a contact form and no user accounts, does not necessarily need a full audit. We will tell you if that is the case.
The deliverable
The same findings ranked by severity, with a remediation for each, reviewed by a person before they are sent. On a WordPress site the remediation is often very concrete: remove a component, close an access, correct a setting.
If you would rather not handle it, Repère can turn the findings into fixes under a second mandate, quoted separately and decided after the report is read.
The frame stays the same
As with any Repère audit, the scope and the authorization are put in writing before any check that goes beyond observing what is already public. The authorization names what may be examined, what is excluded, the permitted checks, the limits and the validity period.
We do not work on a site that is already compromised: that is an emergency and a different trade. The full frame is set out on the audit page.