In this guide: Website security audit in 30 minutes: check accounts and access, software updates, backups, SSL and security headers, and malware scanning — Week 3 recap.
This week we covered website security from every angle: hosting security, WordPress hardening, firewalls, malware, backups, passwords, 2FA, phishing, and email authentication. Now let’s put it into action.
Set a 30-minute timer and run this security audit on your website.
Accounts and access (minutes 0–8)
- ☐ Primary email account has 2FA (preferably passkey or security key).
- ☐ Domain registrar has 2FA and registrar lock enabled; auto-renew is on.
- ☐ Hosting account has 2FA; no unknown users.
- ☐ WordPress users reviewed:
- Remove former employees, freelancers, and test accounts.
- Downgrade unnecessary administrators — see WordPress User Roles Explained.
- Administrators and editors use 2FA.
- ☐ No shared passwords in chat or spreadsheets — use a password manager — see Best Password Managers for Teams.
- ☐ SSH/SFTP access uses keys where possible — see SSH Keys vs Passwords.
- ☐ Social media and ad accounts have 2FA and correct team roles.
Software updates (minutes 8–14)
- ☐ WordPress core is up to date.
- ☐ All plugins and themes updated (test major ones on staging) — see How to Safely Update WordPress.
- ☐ Unused plugins and themes deleted (not just deactivated).
- ☐ No nulled or abandoned plugins.
- ☐ PHP version is currently supported.
- ☐ Vulnerability check using your security plugin’s scanner.
Backups (minutes 14–19)
- ☐ Automatic backups are running — check the latest backup date.
- ☐ Off-site copy exists (not only on your hosting server).
- ☐ Retention of at least 7–30 days.
- ☐ Last restore test was within the last quarter (if not, schedule one).
- ☐ Failure alerts are enabled.
See How to Set Up Automatic Backups.
SSL and headers (minutes 19–24)
- ☐ HTTPS works on all pages; HTTP redirects to HTTPS.
- ☐ SSL certificate is valid and auto-renewing.
- ☐ No mixed content warnings.
- ☐ Security headers checked with an online header scanner:
Strict-Transport-Security (HSTS)X-Content-Type-Options: nosniffReferrer-PolicyX-Frame-Options or CSP frame-ancestorsContent-Security-Policy (advanced — test carefully)- ☐ File editing disabled in WordPress (
DISALLOW_FILE_EDIT).
- ☐ Firewall/WAF active (plugin, host, or CDN) — see WAF Explained.
- ☐ Email authentication (SPF, DKIM, DMARC) set up — see SPF, DKIM and DMARC.
Malware scanning (minutes 24–30)
- ☐ Run a server-side scan with your security plugin or host scanner.
- ☐ Run a remote scan with an online scanner.
- ☐ Check Google Search Console → Security issues.
- ☐ Search
site:yourdomain.com for spam pages.
- ☐ Check
/wp-content/uploads/ for PHP files.
- ☐ Uptime monitoring active with alerts — see Best Uptime Monitoring Tools.
See How to Scan Your Website for Malware.
Your results
Count the unchecked items:
- 0–3 unchecked: Excellent. Fix the remaining items this week.
- 4–8 unchecked: Good foundation, but important gaps. Prioritize accounts, updates, and backups.
- 9+ unchecked: High risk. Start with 2FA on email/registrar/hosting, updates, and off-site backups today.
Schedule it: repeat this audit monthly or quarterly. Security isn’t a one-time project — it’s a habit.
This week’s must-read articles
Next week’s theme: growth and monetization — how to turn your website into a business.
Further reading: OWASP Top 10 web security risks
Key Takeaways: Website Security Audit
- Audit accounts, updates, backups, SSL/headers, and malware in 30 minutes.
- Prioritize 2FA on email, registrar, and hosting.
- Confirm off-site backups and test restores.
- Scan for malware and check Search Console regularly.
- Repeat the audit monthly or quarterly.
