WordPress audit checklist for marketing teams

The short answer

A WordPress site audit is a structured check of whether a WordPress website is fast, secure, visible to search engines and able to turn visitors into enquiries. For a marketing team, that means 30 checks across six areas, most of which take a minute each. The bar is lower than you might expect: only 48% of websites pass Core Web Vitals on mobile, and 95.9% of the top million home pages had detectable accessibility failures in 2026.

This checklist is written for marketing managers who own a WordPress site but are not developers. Each check says why it matters, how to check it yourself, and what a pass looks like. It also marks which checks PostCliq's free public audit covers, so you know which ones you still need to do by hand.

What does a WordPress website audit check?

A WordPress website audit checks six things: how fast key pages load on mobile, whether visible security basics are in place, whether search engines and AI crawlers can reach the pages, whether forms work and deliver, whether content helps a visitor act, and whether enquiries are tracked. A developer audit adds server, code and plugin reviews that need admin access.

The distinction matters. A marketing team audit looks at the site from the outside, the way a buyer and a search engine do, plus what the dashboard shows. It will not find a vulnerable line of code. It will find the broken form, the ticked "discourage search engines" box and the 4-second landing page, which are the problems that cost enquiries this month.

How do you check WordPress speed?

Check WordPress speed by running your five most important pages through PageSpeed Insights on mobile and reading the field data first. A page passes when Largest Contentful Paint is 2.5 seconds or less, Interaction to Next Paint 200 milliseconds or less and layout shift 0.1 or less, for three in four real visits.

Google's thresholds are published on web.dev, which states the standard in one line.

If several of these fail, the causes and fixes are in why is my WordPress site so slow. Test logged out, in a private window, because most page caching is skipped for logged-in users.

How do you check WordPress security without logging in to a scanner?

Check visible WordPress security by confirming the site runs on HTTPS everywhere, sends basic security headers, and has no pending updates or critical issues in Tools > Site Health. That is not a full security audit. It is the part a marketing manager can verify, and it catches the most common neglect.

Most WordPress risk sits in plugins. Patchstack counted 11,334 new WordPress ecosystem vulnerabilities in 2025, 91% in plugins, and 46% had no fix at public disclosure. Patchstack sells security software, so read the count as a vendor's, but the practical conclusion does not depend on the exact number: update often and remove what you do not use.

Can search engines and AI crawlers reach your WordPress site?

Check search access by confirming WordPress is not set to discourage search engines, robots.txt does not block key pages, a sitemap exists and is submitted to Search Console, and your key pages are indexed. Add one check that most audits skip: that AI search crawlers are not blocked, because buyers increasingly ask AI tools before they click.

The WordPress setting is under Settings > Reading, and Site Health reports it as "Is this site discouraging search engines?" (WordPress documentation). It is often left ticked after a launch.

Do your WordPress forms work and deliver?

Check WordPress forms by submitting a real test enquiry through every form, on mobile and desktop, and confirming the notification arrives in the right inbox and not in spam. Then check the form is short, labelled and clear about what happens next. A form that fails silently costs more than any other problem on this list.

Email delivery is the hidden failure. Gmail has required every sender to set up SPF or DKIM authentication since February 2024, and form notifications sent from a web server without it often go to spam. The common WordPress problems guide shows what three weeks of silent failure costs.

The enquiry form review kit goes deeper on field-by-field review.

Does your content help a visitor enquire?

Check content by reading each key page as a first-time buyer: does it say who you help and what happens next within a few seconds, is there a clear call to action, do the buttons and links work, and is there evidence a buyer can trust? Out-of-date content on a service page quietly undermines everything above it.

Is every enquiry being tracked?

Check tracking by confirming Google Analytics 4 runs on every page, form submissions are recorded as key events, and Search Console is verified for the site. If GA4 shows sessions but no enquiries, you cannot tell which channel works. Tracking is often broken by a theme change, a new form plugin or a consent banner.

Google Analytics is on 47.2% of all websites (W3Techs, September 2026), but that counts the tag, not whether it records anything useful. The GA4 audit checklist covers the configuration in detail.

How long does a WordPress audit take, and how should you record it?

A marketing team can run this 30-point WordPress audit in about two hours: roughly an hour for speed, search and security checks, and an hour for forms, content and tracking. Record every check as pass or fail with an owner and a date. An audit without owners is a list, not a plan.

A worked example: turning the checklist into a plan

Suppose the audit finds 8 fails out of 30. Group them by owner rather than by area:

• Marketing team (3): hero image too large (check 5), expired offer on the services page (28), unlabelled phone field (23, with the developer).
• Developer (4): form email not authenticated (21), unused JavaScript from an old chat tool (6), two inactive plugins (11), form events not tracked (29).
• Host (1): no restore test in the last year (12).

Then order by what costs enquiries now. Check 21 comes first, because an unauthenticated form email may be losing enquiries today. Check 5 comes second, because the hero image is on the page that gets most paid traffic. The inactive plugins take five minutes and remove risk, so they go early too. The website fix brief template turns each fail into a ticket.

Where PostCliq fits

PostCliq is a free website audit from WP Creative. On a WordPress site it covers the outside-in checks in this list automatically: speed and page experience, visible security signals, search access, forms and calls to action, content clarity, trust signals and AI readiness, across up to 50 public pages. It reports evidence and three quick wins to make first, and you can re-audit each site once a week to see whether fixes held. It never logs in, submits forms or installs plugins, so checks 10 to 12, 19 to 22 and the dashboard steps stay with you. The WordPress audit page sets out what is covered today.

For hands-on fixing, WP Creative, an Australian website growth agency, builds and maintains WordPress sites; WP Creative reports more than 10 years in business and more than 1,200 websites delivered.

What to do next

1. Copy the six tables into a spreadsheet and add two columns: owner and date.
2. Start with checks 19 to 21. Submit a test enquiry through every form and confirm the email arrives in the inbox.
3. Run your five key pages through PageSpeed Insights on mobile and record checks 1 to 6.
4. Run a free PostCliq audit to cover the public checks across up to 50 pages at once, then do the dashboard and form checks by hand.
5. If you only have an hour, use the one-hour website check instead, then come back to this list.
6. Read the pillar guide on WordPress speed and why sites slow down, or browse every guide on WordPress performance.

Frequently asked questions

What is a WordPress health check?

A WordPress health check usually means the built-in Site Health tool, found under Tools > Site Health in the dashboard. It flags critical issues such as an outdated PHP version, pending plugin updates and failed background updates, and lists technical details about the server, theme and plugins. It is a useful start, but it does not test speed for real visitors, forms or search access.

How do I audit a WordPress website?

Work through six areas in order: speed, visible security, search access, forms, content and tracking. Use PageSpeed Insights for speed, Tools > Site Health for updates and configuration, Google Search Console for indexing, and a real test submission for every form. Record pass or fail, an owner and a date for each check, then re-check the fails a week later.

How often should you audit a WordPress site?

Run the full checklist every quarter and after any major change, such as a redesign, a host move or a new form plugin. Some checks deserve a tighter rhythm: test every form monthly and after plugin updates, and check pending updates weekly. A weekly re-audit of the public pages catches regressions between full reviews.

What is the difference between a WordPress audit and a WordPress security audit?

A WordPress audit covers the whole site: speed, search access, forms, content, tracking and visible security. A WordPress security audit goes deeper on security alone, reviewing plugins, user accounts, file permissions, server configuration and logs, and needs admin or server access. Marketing teams can run the first. The second belongs with a developer or security specialist.

Can I audit a WordPress site without logging in?

Yes, for most of it. Speed, HTTPS, security headers, robots.txt, sitemaps, noindex tags, content, calls to action and form design are all visible from outside. Pending updates, inactive plugins and stored form entries need a dashboard login. Whether form emails arrive needs a real test submission, which no outside tool should do on your behalf.

How much does a WordPress website audit cost?

A self-run audit with this checklist costs only staff time, about two hours. PostCliq's public audit is free, with one standard audit per site every seven days. A developer or agency audit that includes code, plugins and server review is priced by scope, so ask for a fixed quote with named deliverables.