---
title: "WordPress site audit: a checklist for marketers | PostCliq"
description: "A 30-point WordPress site audit for marketing teams: speed, security, search access, forms, content and tracking, each with a check you can run yourself."
url: "https://postcliq.com/blog/wordpress-audit-checklist"
---

# WordPress audit checklist for marketing teams

A WordPress site audit a marketing manager can run in two hours: 30 checks across speed, visible security, search access, forms, content and tracking, each with how to check it yourself.

By [Nirmal Gyanwali](https://postcliq.com/blog/author/nirmal-gyanwali) Updated 15 October 2026 7 min read

On this page

1. The short answer
2. What does a WordPress website audit check?
3. How do you check WordPress speed?
4. How do you check WordPress security without logging in to a scanner?
5. Can search engines and AI crawlers reach your WordPress site?
6. Do your WordPress forms work and deliver?
7. Does your content help a visitor enquire?
8. Is every enquiry being tracked?
9. How long does a WordPress audit take, and how should you record it?
10. What to do next
11. Frequently asked questions

## The short answer

Key takeaways

- A WordPress site audit for a marketing team checks six areas: speed, visible security, search access, forms, content and tracking.
- This checklist has 30 checks, and every one can be done by a marketing manager with a browser, the WordPress dashboard and free Google tools.
- Only 48% of websites pass Core Web Vitals on mobile, and WordPress sites pass slightly less often, at 45%, according to the HTTP Archive Web Almanac 2025.
- The checks that find the most lost enquiries are the least technical: submit every form and confirm the email arrives.
- Record a pass, a fail and an owner for every check, then re-check the fails in a week.

A WordPress site audit is a structured check of whether a WordPress website is fast, secure, visible to search engines and able to turn visitors into enquiries. For a marketing team, that means 30 checks across six areas, most of which take a minute each. The bar is lower than you might expect: only [48% of websites pass Core Web Vitals on mobile](https://almanac.httparchive.org/en/2025/performance) , and [95.9% of the top million home pages had detectable accessibility failures](https://webaim.org/projects/million/) in 2026.

This checklist is written for marketing managers who own a WordPress site but are not developers. Each check says why it matters, how to check it yourself, and what a pass looks like. It also marks which checks PostCliq's free public audit covers, so you know which ones you still need to do by hand.

## What does a WordPress website audit check?

A WordPress website audit checks six things: how fast key pages load on mobile, whether visible security basics are in place, whether search engines and AI crawlers can reach the pages, whether forms work and deliver, whether content helps a visitor act, and whether enquiries are tracked. A developer audit adds server, code and plugin reviews that need admin access.

The distinction matters. A marketing team audit looks at the site from the outside, the way a buyer and a search engine do, plus what the dashboard shows. It will not find a vulnerable line of code. It will find the broken form, the ticked "discourage search engines" box and the 4-second landing page, which are the problems that cost enquiries this month.

Why the basics are worth checking

**48%** of websites pass all Core Web Vitals on mobile [HTTP Archive Web Almanac 2025](https://almanac.httparchive.org/en/2025/performance)

**91%** of new WordPress vulnerabilities in 2025 were in plugins [Patchstack, 2026 (vendor)](https://www.patchstack.com/whitepaper/state-of-wordpress-security-in-2026/)

**51%** of top home pages had form inputs without labels [WebAIM Million 2026](https://webaim.org/projects/million/)

**34%** of people who start a form do not finish it [Zuko (vendor)](https://zuko.io/blog/8-surprising-insights-from-zukos-benchmarking-data)

## How do you check WordPress speed?

Check WordPress speed by running your five most important pages through PageSpeed Insights on mobile and reading the field data first. A page passes when Largest Contentful Paint is 2.5 seconds or less, Interaction to Next Paint 200 milliseconds or less and layout shift 0.1 or less, for three in four real visits.

Google's thresholds are published on [web.dev](https://web.dev/articles/vitals) , which states the standard in one line.

> A good threshold to measure is the 75th percentile of page loads, segmented across mobile and desktop devices.

web.dev, Google's web performance guidance

| # | Check | Check it yourself | Pass looks like | PostCliq public audit |
| --- | --- | --- | --- | --- |
| 1 | Main content appears fast on mobile | PageSpeed Insights, mobile, field data for your top landing page | LCP 2.5 s or less | ✓ lab and field data |
| 2 | Pages respond to taps quickly | Same report, INP | INP 200 ms or less | ✓ where field data exists |
| 3 | Layout does not jump while loading | Same report, CLS | CLS 0.1 or less | ✓ |
| 4 | The server answers quickly | PageSpeed "Server response time" or TTFB | Under 0.8 s | ✓ |
| 5 | Hero images are sized for the screen | PageSpeed "Properly size images"; check the LCP element | No hero image over a few hundred KB | ✓ |
| 6 | Only needed scripts load | PageSpeed "Reduce unused JavaScript"; list third-party tags | Every tag has a named owner and a current use | ◐ flags heavy scripts |

Source: thresholds from web.dev; checks are PostCliq analysis

If several of these fail, the causes and fixes are in [why is my WordPress site so slow](https://postcliq.com/blog/why-is-my-wordpress-site-slow) . Test logged out, in a private window, because most page caching is skipped for logged-in users.

## How do you check WordPress security without logging in to a scanner?

Check visible WordPress security by confirming the site runs on HTTPS everywhere, sends basic security headers, and has no pending updates or critical issues in Tools > Site Health. That is not a full security audit. It is the part a marketing manager can verify, and it catches the most common neglect.

Most WordPress risk sits in plugins. Patchstack counted [11,334 new WordPress ecosystem vulnerabilities in 2025](https://www.patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) , 91% in plugins, and 46% had no fix at public disclosure. Patchstack sells security software, so read the count as a vendor's, but the practical conclusion does not depend on the exact number: update often and remove what you do not use.

| # | Check | Check it yourself | Pass looks like | PostCliq public audit |
| --- | --- | --- | --- | --- |
| 7 | HTTPS on every page | Visit several pages; look for the padlock and "https" | No page loads over plain http | ✓ |
| 8 | http redirects to https | Type your address with "http://" | You land on the https version | ◐ |
| 9 | Basic security headers are sent | Ask your developer, or use a free header checker | HSTS and content-type protection present | ✓ visible headers |
| 10 | No pending plugin, theme or core updates | Dashboard > Updates, and Tools > Site Health | Nothing waiting more than a week | ✕ needs a login |
| 11 | No unused or inactive plugins | Tools > Site Health > Info > Inactive plugins | Inactive list is empty | ✕ needs a login |
| 12 | Backups exist and have been restored as a test | Ask your host for the last restore test date | A restore tested in the last quarter | ✕ |

Source: PostCliq analysis; Site Health locations from WordPress documentation

## Can search engines and AI crawlers reach your WordPress site?

Check search access by confirming WordPress is not set to discourage search engines, robots.txt does not block key pages, a sitemap exists and is submitted to Search Console, and your key pages are indexed. Add one check that most audits skip: that AI search crawlers are not blocked, because buyers increasingly ask AI tools before they click.

The WordPress setting is under Settings > Reading, and Site Health reports it as "Is this site discouraging search engines?" ( [WordPress documentation](https://wordpress.org/documentation/article/site-health-screen/) ). It is often left ticked after a launch.

| # | Check | Check it yourself | Pass looks like | PostCliq public audit |
| --- | --- | --- | --- | --- |
| 13 | Search engines are not discouraged | Settings > Reading | "Discourage search engines" unticked | ✓ via indexing signals |
| 14 | robots.txt does not block key pages | Open yoursite.com/robots.txt | No "Disallow: /" and no key folders blocked | ✓ |
| 15 | An XML sitemap exists and is current | Open the sitemap your SEO plugin creates; check Search Console > Sitemaps | Sitemap lists live pages only, submitted, no errors | ✓ |
| 16 | Key pages are indexed | Search Console > URL inspection for each key page | "URL is on Google" | ◐ reads indexing signals |
| 17 | No accidental noindex on key pages | View page source, search for "noindex" | Only on pages you meant to hide | ✓ |
| 18 | AI search crawlers are allowed | Check robots.txt for OAI-SearchBot, Claude-SearchBot, PerplexityBot | Not disallowed | ✓ AI readiness |

Source: PostCliq analysis

## Do your WordPress forms work and deliver?

Check WordPress forms by submitting a real test enquiry through every form, on mobile and desktop, and confirming the notification arrives in the right inbox and not in spam. Then check the form is short, labelled and clear about what happens next. A form that fails silently costs more than any other problem on this list.

Email delivery is the hidden failure. Gmail has required every sender to [set up SPF or DKIM authentication](https://support.google.com/a/answer/81126) since February 2024, and form notifications sent from a web server without it often go to spam. The [common WordPress problems guide](https://postcliq.com/blog/common-wordpress-problems) shows what three weeks of silent failure costs.

| # | Check | Check it yourself | Pass looks like | PostCliq public audit |
| --- | --- | --- | --- | --- |
| 19 | Every form submits | Submit a test enquiry on each form, on your phone | Confirmation shown, no error | ✕ never submits forms |
| 20 | The notification arrives in the inbox | Check the receiving inbox and its spam folder | Arrives in minutes, not in spam | ✕ |
| 21 | Form email is authenticated | Ask your developer whether form email uses SPF and DKIM on your domain | Yes, through an authenticated mail service | ✕ |
| 22 | Submissions are stored as a backup | Look for form entries in the dashboard | Every test entry recorded | ✕ needs a login |
| 23 | Every field has a visible label | Look at the form; placeholders alone do not count | Label on every field | ✓ accessibility |
| 24 | The form asks only what you need | Count the fields; ask sales which ones they use | Every field has a use | ✓ field count |

Source: PostCliq analysis; Gmail requirements from Google Workspace Admin Help

The [enquiry form review kit](https://postcliq.com/resources/enquiry-form-review-kit) goes deeper on field-by-field review.

## Does your content help a visitor enquire?

Check content by reading each key page as a first-time buyer: does it say who you help and what happens next within a few seconds, is there a clear call to action, do the buttons and links work, and is there evidence a buyer can trust? Out-of-date content on a service page quietly undermines everything above it.

| # | Check | Check it yourself | Pass looks like | PostCliq public audit |
| --- | --- | --- | --- | --- |
| 25 | Each key page says who it is for and the next step | Read the first screen on your phone | Clear in five seconds | ✓ content clarity |
| 26 | Calls to action lead somewhere that works | Click every button on key pages | No 404s, no dead ends | ✓ |
| 27 | Proof is present and current | Look for reviews, case studies, named clients | Real, dated, relevant proof near the call to action | ✓ trust signals |
| 28 | Nothing is out of date | Scan for old offers, past events, departed staff, old years | Nothing expired on key pages | ✕ |

Source: PostCliq analysis

## Is every enquiry being tracked?

Check tracking by confirming Google Analytics 4 runs on every page, form submissions are recorded as key events, and Search Console is verified for the site. If GA4 shows sessions but no enquiries, you cannot tell which channel works. Tracking is often broken by a theme change, a new form plugin or a consent banner.

Google Analytics is on [47.2% of all websites](https://w3techs.com/technologies/details/ta-googleanalytics) (W3Techs, September 2026), but that counts the tag, not whether it records anything useful. The [GA4 audit checklist](https://postcliq.com/blog/ga4-audit-checklist) covers the configuration in detail.

| # | Check | Check it yourself | Pass looks like | PostCliq public audit |
| --- | --- | --- | --- | --- |
| 29 | Form submissions are tracked as key events | Submit a test enquiry, then check GA4 > Realtime | The event appears within minutes | ◐ The read-only GA4 connection shows enquiries by landing page |
| 30 | Search Console is verified and receiving data | Open Search Console > Performance | Clicks and impressions for the last 28 days | ◐ The read-only Search Console connection shows clicks and impressions by page |

Source: PostCliq analysis

## How long does a WordPress audit take, and how should you record it?

A marketing team can run this 30-point WordPress audit in about two hours: roughly an hour for speed, search and security checks, and an hour for forms, content and tracking. Record every check as pass or fail with an owner and a date. An audit without owners is a list, not a plan.

### A worked example: turning the checklist into a plan

Suppose the audit finds 8 fails out of 30. Group them by owner rather than by area:

- **Marketing team (3):** hero image too large (check 5), expired offer on the services page (28), unlabelled phone field (23, with the developer).
- **Developer (4):** form email not authenticated (21), unused JavaScript from an old chat tool (6), two inactive plugins (11), form events not tracked (29).
- **Host (1):** no restore test in the last year (12).

Then order by what costs enquiries now. Check 21 comes first, because an unauthenticated form email may be losing enquiries today. Check 5 comes second, because the hero image is on the page that gets most paid traffic. The inactive plugins take five minutes and remove risk, so they go early too. The [website fix brief template](https://postcliq.com/resources/website-fix-brief-template) turns each fail into a ticket.

### Where PostCliq fits

PostCliq is a free website audit from WP Creative. On a WordPress site it covers the outside-in checks in this list automatically: speed and page experience, visible security signals, search access, forms and calls to action, content clarity, trust signals and AI readiness, across up to 50 public pages. It reports evidence and three quick wins to make first, and you can re-audit each site once a week to see whether fixes held. It never logs in, submits forms or installs plugins, so checks 10 to 12, 19 to 22 and the dashboard steps stay with you. The [WordPress audit page](https://postcliq.com/wordpress-audit) sets out what is covered today.

For hands-on fixing, WP Creative, an Australian website growth agency, builds and maintains WordPress sites; WP Creative reports more than 10 years in business and more than 1,200 websites delivered.

## What to do next

1. Copy the six tables into a spreadsheet and add two columns: owner and date.
2. Start with checks 19 to 21. Submit a test enquiry through every form and confirm the email arrives in the inbox.
3. Run your five key pages through PageSpeed Insights on mobile and record checks 1 to 6.
4. Run a [free PostCliq audit](https://postcliq.com/#try-postcliq) to cover the public checks across up to 50 pages at once, then do the dashboard and form checks by hand.
5. If you only have an hour, use the [one-hour website check](https://postcliq.com/resources/one-hour-website-check) instead, then come back to this list.
6. Read the pillar guide on [WordPress speed and why sites slow down](https://postcliq.com/blog/why-is-my-wordpress-site-slow) , or browse every guide on [WordPress performance](https://postcliq.com/blog/topic/wordpress) .

## Frequently asked questions

### What is a WordPress health check?

A WordPress health check usually means the built-in Site Health tool, found under Tools > Site Health in the dashboard. It flags critical issues such as an outdated PHP version, pending plugin updates and failed background updates, and lists technical details about the server, theme and plugins. It is a useful start, but it does not test speed for real visitors, forms or search access.

### How do I audit a WordPress website?

Work through six areas in order: speed, visible security, search access, forms, content and tracking. Use PageSpeed Insights for speed, Tools > Site Health for updates and configuration, Google Search Console for indexing, and a real test submission for every form. Record pass or fail, an owner and a date for each check, then re-check the fails a week later.

### How often should you audit a WordPress site?

Run the full checklist every quarter and after any major change, such as a redesign, a host move or a new form plugin. Some checks deserve a tighter rhythm: test every form monthly and after plugin updates, and check pending updates weekly. A weekly re-audit of the public pages catches regressions between full reviews.

### What is the difference between a WordPress audit and a WordPress security audit?

A WordPress audit covers the whole site: speed, search access, forms, content, tracking and visible security. A WordPress security audit goes deeper on security alone, reviewing plugins, user accounts, file permissions, server configuration and logs, and needs admin or server access. Marketing teams can run the first. The second belongs with a developer or security specialist.

### Can I audit a WordPress site without logging in?

Yes, for most of it. Speed, HTTPS, security headers, robots.txt, sitemaps, noindex tags, content, calls to action and form design are all visible from outside. Pending updates, inactive plugins and stored form entries need a dashboard login. Whether form emails arrive needs a real test submission, which no outside tool should do on your behalf.

### How much does a WordPress website audit cost?

A self-run audit with this checklist costs only staff time, about two hours. PostCliq's public audit is free, with one standard audit per site every seven days. A developer or agency audit that includes code, plugins and server review is priced by scope, so ask for a fixed quote with named deliverables.

## Run the public checks. Free, in minutes.

PostCliq covers the outside-in checks across up to 50 public pages, with evidence and three quick wins to make first.

Free. No credit card.

![Nirmal Gyanwali, founder and chief executive of WP Creative.](https://postcliq.com/authors/nirmal-gyanwali.jpg)

Written by

[Nirmal Gyanwali](https://postcliq.com/blog/author/nirmal-gyanwali)

Founder and CEO, WP Creative · Sydney, Australia

Nirmal Gyanwali has spent more than twenty years building websites, and most of that time watching them fail at the one job the business actually bought them for, which is turning a visitor into an enquiry. He founded WP Creative in Sydney in January 2016.

- [LinkedIn](https://www.linkedin.com/in/nirmalgyanwali/)
- [YouTube](https://www.youtube.com/@nirmalgyanwali)
- [Instagram](https://www.instagram.com/nirmalgyanwali)
- [TikTok](https://www.tiktok.com/@nirmalwpc)

## Keep reading

- [**Why is my WordPress site so slow? Causes, tests and fixes**](https://postcliq.com/blog/why-is-my-wordpress-site-slow)
- [**Common WordPress problems that quietly cost enquiries**](https://postcliq.com/blog/common-wordpress-problems)
- [**How to write a website brief so the fix actually gets done**](https://postcliq.com/blog/how-to-brief-a-website-fix)

[More on WordPress performance](https://postcliq.com/blog/topic/wordpress) · [All articles](https://postcliq.com/blog)