Week 3 Recap: Website Security Audit in 30 Minutes

In this guide: Website security audit in 30 minutes: check accounts and access, software updates, backups, SSL and security headers, and malware scanning — Week 3 recap.

This week we covered website security from every angle: hosting security, WordPress hardening, firewalls, malware, backups, passwords, 2FA, phishing, and email authentication. Now let’s put it into action.

Set a 30-minute timer and run this security audit on your website.

Accounts and access (minutes 0–8)

• ☐ Primary email account has 2FA (preferably passkey or security key).
• ☐ Domain registrar has 2FA and registrar lock enabled; auto-renew is on.
• ☐ Hosting account has 2FA; no unknown users.
• ☐ WordPress users reviewed:
• Remove former employees, freelancers, and test accounts.
• Downgrade unnecessary administrators — see WordPress User Roles Explained.
• Administrators and editors use 2FA.
• ☐ No shared passwords in chat or spreadsheets — use a password manager — see Best Password Managers for Teams.
• ☐ SSH/SFTP access uses keys where possible — see SSH Keys vs Passwords.
• ☐ Social media and ad accounts have 2FA and correct team roles.

Software updates (minutes 8–14)

• ☐ WordPress core is up to date.
• ☐ All plugins and themes updated (test major ones on staging) — see How to Safely Update WordPress.
• ☐ Unused plugins and themes deleted (not just deactivated).
• ☐ No nulled or abandoned plugins.
• ☐ PHP version is currently supported.
• ☐ Vulnerability check using your security plugin’s scanner.

Backups (minutes 14–19)

• ☐ Automatic backups are running — check the latest backup date.
• ☐ Off-site copy exists (not only on your hosting server).
• ☐ Retention of at least 7–30 days.
• ☐ Last restore test was within the last quarter (if not, schedule one).
• ☐ Failure alerts are enabled.

See How to Set Up Automatic Backups.

SSL and headers (minutes 19–24)

• ☐ HTTPS works on all pages; HTTP redirects to HTTPS.
• ☐ SSL certificate is valid and auto-renewing.
• ☐ No mixed content warnings.
• ☐ Security headers checked with an online header scanner:
• Strict-Transport-Security (HSTS)
• X-Content-Type-Options: nosniff
• Referrer-Policy
• X-Frame-Options or CSP frame-ancestors
• Content-Security-Policy (advanced — test carefully)
• ☐ File editing disabled in WordPress (DISALLOW_FILE_EDIT).
• ☐ Firewall/WAF active (plugin, host, or CDN) — see WAF Explained.
• ☐ Email authentication (SPF, DKIM, DMARC) set up — see SPF, DKIM and DMARC.

Malware scanning (minutes 24–30)

• ☐ Run a server-side scan with your security plugin or host scanner.
• ☐ Run a remote scan with an online scanner.
• ☐ Check Google Search Console → Security issues.
• ☐ Search site:yourdomain.com for spam pages.
• ☐ Check /wp-content/uploads/ for PHP files.
• ☐ Uptime monitoring active with alerts — see Best Uptime Monitoring Tools.

See How to Scan Your Website for Malware.

Your results

Count the unchecked items:

• 0–3 unchecked: Excellent. Fix the remaining items this week.
• 4–8 unchecked: Good foundation, but important gaps. Prioritize accounts, updates, and backups.
• 9+ unchecked: High risk. Start with 2FA on email/registrar/hosting, updates, and off-site backups today.

Schedule it: repeat this audit monthly or quarterly. Security isn’t a one-time project — it’s a habit.

This week’s must-read articles

• WordPress Security: The Complete 2026 Checklist
• How to Fix a Hacked WordPress Site Step by Step
• Phishing Emails: How to Spot Them in 5 Seconds
• DDoS Attacks Explained
• Crisis Communication: What to Say When Your Site Goes Down

Next week’s theme: growth and monetization — how to turn your website into a business.

Further reading: OWASP Top 10 web security risks

Key Takeaways: Website Security Audit

• Audit accounts, updates, backups, SSL/headers, and malware in 30 minutes.
• Prioritize 2FA on email, registrar, and hosting.
• Confirm off-site backups and test restores.
• Scan for malware and check Search Console regularly.
• Repeat the audit monthly or quarterly.