WordPress and WooCommerce Technical Audit: What to Check to Sell More and Avoid Surprises

A WordPress and WooCommerce technical audit checklist: security, performance, plugins, payments, technical SEO and backups. When to do one and what the report should include.

A WordPress website or WooCommerce store can run for years without anyone looking under the bonnet, until it stops working: an outdated plugin opens a security hole, checkout fails on mobile and nobody notices, or the site becomes so slow that Google and customers give up on it.

A technical audit is a complete, systematic review that finds those problems before they cost money. In this guide we explain when to run one, what we check in each area, how we prioritise findings and what comes next.

When to run an audit

• You've inherited the website from another agency or a developer who's no longer available.
• The site is slow, throws errors or sales have dropped for no clear reason.
• You're about to redesign, change hosting or launch a major campaign.
• Nobody has reviewed updates, security and backups for more than a year.
• You've been hacked or had a scare and want to know if anything is still outstanding.

• Outdated pluginsNot reviewed for over 6 months
• Slow on mobileCore Web Vitals in the red
• No tested backupsThey exist, but nobody has ever restored one
• Checkout errorsEspecially on mobile or with certain payment methods
• Emails not arrivingOrder confirmations going to spam

What we check

1. Security

WordPress is secure if it's maintained. Most incidents come through outdated plugins or themes, weak passwords or forgotten access.

• WordPress, PHP, theme and plugin versions against known vulnerabilities.
• Administrator users: who has access, passwords, two-factor authentication and accounts that should no longer exist.
• File permissions, wp-config.php settings, file editor disabled.
• SSL certificate, HTTPS redirects and security headers.
• Signs of malicious code, hidden users or modified files.
• Login protection against brute-force attacks.

2. Performance

Speed affects conversion and rankings. We measure Core Web Vitals (LCP, INP, CLS) on mobile and desktop and look for the causes:

• Unoptimised images or images without modern formats (WebP, AVIF).
• Scripts and stylesheets loaded on every page even though they're only used on one.
• Heavy page builders and plugins that add external requests.
• Misconfigured caching, slow database queries and an old PHP version.
• Database tables bloated with revisions, transients or plugin logs.

3. Plugins and theme

Every plugin is third-party code that has to be maintained. We review abandoned or duplicate plugins, or plugins that do the same job as another, conflicts and errors in the PHP log, and customisations made directly in the theme that would be lost on update. Sometimes several pieces can be replaced by a lighter, more secure custom plugin.

4. WooCommerce and payments

• The full checkout on different devices, browsers and payment methods (Stripe, PayPal, Redsys, Bizum).
• Transactional emails: that they arrive, don't end up in spam and contain the right information.
• Taxes, shipping, stock and sync with ERP or logistics.
• Abandoned carts and friction: unnecessary fields, forced registration, costs that appear at the end.

5. Technical SEO

• Indexing, sitemap, robots.txt, redirects and 404 errors.
• Product structured data, titles and descriptions.
• Duplicate content generated by filters, tags and product variations.
• Mobile version, broken links and canonicals.

6. Backups and recovery

Many websites have backups; few have ever tried restoring one. We check whether they exist, where they're stored (never only on the same server), how often they run and whether restoring works. We also check whether there's a staging environment to update without risk.

What the report should include

A good audit isn't an endless list of automated warnings. It should prioritise with business sense and estimate the effort for each point, so you can decide what to fix first and with what budget.

Finding	Area	Priority	Effort
Forms plugin with a known vulnerability	Security	Urgent	Low
Card payment fails on mobile Safari	WooCommerce	High	Medium
Unoptimised product images (4 MB)	Performance	High	Low
Three plugins doing the same job	Plugins	Medium	Medium
Filters generate indexable duplicate pages	SEO	Medium	Low

After the audit: maintenance

Fixing the problems is half the job; the other half is stopping them from coming back. A professional maintenance plan includes updates tested in staging, verified backups, security monitoring and regular performance reviews.

It's what we do, for example, for Ayurveda Living by M.E., whose website we didn't build but maintain and improve continuously.

How we run an audit

1. 01AccessTemporary user, hosting and analytics
2. 02BackupA full backup before touching anything
3. 03ReviewAll six areas, with tools and manual review
4. 04ReportPrioritised findings with estimated effort
5. 05MeetingWe walk you through it and you decide what to tackle

Frequently asked questions

Does the audit affect how the website works?

No. We work with a full backup and, when changes need testing, in a staging environment. The website keeps running normally.

Do I have to hire you for the fixes?

No. The report is yours and is written so any technical team can act on it. If you'd rather we do it, we'll quote you point by point.

How often should it be repeated?

If the website has ongoing maintenance, a full review once a year is enough. If not, we recommend reviewing it at least every six months.

Conclusion

A technical audit turns uncertainty into a clear list of actions: what's urgent, what affects sales and what can wait. It's the cheapest way to avoid expensive problems.

If you want to know what state your website or online store is in, ask us for an audit. We'll give you a clear, prioritised report, and you decide what to do with it.