---
title: Security audit
canonical: https://wpsecurityninja.com/dictionary/security-audit/
---
# Security audit

A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.

[Full guide](https://wpsecurityninja.com/wordpress-security-audit-guide/)

## Why it matters for WordPress

Gut feel is not a plan. An audit turns “we should be more secure” into ordered work: outdated plugins, leftover admins, missing backups, open XML-RPC, weak login controls. Agencies use the same pass before launch or after a scare.

## How it shows up in practice

- Scored security tests with pass/fail items you can re-run
- A spreadsheet of plugin versions next to known CVEs
- External review notes before go-live or after a compromise
- Monthly checks on client sites where nobody watches the dashboard daily

## What to do

1. Inventory software, users with elevated roles, and backup restore proof.
2. Run automated tests, then verify anything that looks wrong (false positives happen).
3. Fix high-impact issues first: admin access, known CVEs, missing restores.
4. Re-run after changes so the report matches the live site.

## In WP Security Ninja

[Security tests](https://wpsecurityninja.com/security-tests/) give a structured hardening checklist you can re-run after fixes. Combine them with the [vulnerability scanner](https://wpsecurityninja.com/vulnerabilities/) so configuration issues and known CVEs show up in one review cycle. Full walkthrough: [WordPress security audit guide](https://wpsecurityninja.com/wordpress-security-audit-guide/).