14/10/2026
You can audit your WordPress site's security in under an hour, using nothing but your dashboard and a browser. No tools to buy, nothing to install.
Seven checks. The one most people skip is the difference between a plugin that is out of date and a plugin that has been abandoned. The first is a task you do this afternoon. The second is a decision, because no update is ever coming for it.
If you do only one thing on the list, turn on multi-factor authentication. Highest value per minute of anything here.
For a sense of scale β over one five-week stretch, Wordfence disclosed between 75 and 259 WordPress vulnerabilities per week, with one week reaching 249. That is the background rate whether or not anyone is checking your site.
The full seven-check list: https://insights.cloudgeeks.com.au/blog/audit-wordpress-security-under-an-hour-checklist/