Website Security Audit: What to Check Before Year-End (2026)

Why a Year-End Security Audit Matters

Every change to a website introduces potential risk. A new plugin adds code you did not write. A developer account created for a freelancer six months ago still has admin access. A TLS certificate quietly approaches expiration. These small risks compound over a year.

• Holiday traffic increases exposure. More visitors means more attack surface. Bot traffic spikes during Q4 as automated scanners probe for weak targets.
• Regulatory compliance cycles. PCI DSS, SOC 2 and HIPAA require annual security reviews. Completing your audit before year-end aligns with reporting cycles.
• Budget planning. Identifying gaps before the new fiscal year lets you allocate remediation budget. Discovering a critical vulnerability in March with no budget is preventable.

Refer to our WordPress security checklist for a quick-reference version you can run monthly.

The 10-Point Website Security Audit Checklist

This checklist covers the critical areas that catch the majority of production vulnerabilities. Document findings as you go because the report itself is valuable for compliance.

1. SSL/TLS certificate review and configuration
2. Plugin and theme audit
3. User account cleanup and access control
4. Backup verification and disaster recovery testing
5. Security headers check and configuration
6. File permission and directory access review
7. Database security and credential rotation
8. Malware scan and file integrity check
9. Logging and monitoring verification
10. Incident response plan review

SSL/TLS Certificate Review

An expired or misconfigured SSL certificate is one of the most visible security failures. Browsers display prominent warnings that destroy visitor trust. Search engines demote sites with certificate issues.

• Expiration date: Verify your certificate does not expire within 90 days. Auto-renewal through Let’s Encrypt is the safest approach.
• Certificate chain: Use SSL Labs (ssllabs.com/ssltest) to verify the chain is complete. Target an A or A+ grade.
• TLS version: TLS 1.2 minimum, TLS 1.3 preferred. Disable TLS 1.0 and 1.1 because they have known exploitable vulnerabilities.
• Cipher suites: Disable weak ciphers (RC4, DES, 3DES). Prefer AEAD suites like AES-256-GCM and ChaCha20-Poly1305.
• HSTS header: Set Strict-Transport-Security with max-age of at least 31536000 and includeSubDomains.
• Mixed content: Scan every page for resources loaded over HTTP. Browser developer tools flag these in the console.

Plugin and Theme Audit

Plugins and themes are the number one attack vector for WordPress sites. A plugin safe at installation may have disclosed vulnerabilities, been abandoned or been sold to a malicious actor since your last review.

1. List all installed plugins with version numbers and active/inactive status.
2. Delete inactive plugins. Deactivated plugins still exist on your server and their code is still accessible to attackers.
3. Check vulnerability databases. Search WPScan and the National Vulnerability Database for each plugin. Prioritize any with recent CVEs.
4. Verify developer activity. A plugin not updated in over a year is a risk. Abandoned plugins should be replaced.
5. Update everything. Test on staging first. Verify forms, checkout and login before pushing to production.

Apply the same process to themes. Delete all inactive themes except one default WordPress theme as a fallback. Review custom theme functions.php files for hardcoded credentials or debug output. Our guide on securing the WordPress REST API covers endpoint hardening for custom code.

User Account Cleanup and Access Control

Every account with admin or editor access is a potential entry point. Year-end is the time to enforce the principle of least privilege.

• Remove dormant accounts. Any account not logged in within 90 days should be disabled or deleted. Former employees and past freelancers accumulate over a year.
• Review role assignments. Does the content writer need admin access? Downgrade every account to the minimum role required.
• Enforce 2FA on all admin and editor accounts. Use TOTP authenticator apps rather than SMS because SIM-swapping makes SMS unreliable.
• Eliminate shared accounts. Every person gets their own login for accountability and audit trail.
• Rotate passwords. Force a reset for all accounts. Require 16+ characters and encourage password manager usage.

Backup Verification and Disaster Recovery

Having backups is not the same as having working backups. The year-end audit is when you prove yours actually work.

• Verify schedule: Confirm automated backups run on schedule. Daily is the minimum. Ecommerce sites should back up every 6-12 hours.
• Test a restore: Download your most recent backup and restore it to staging. If you cannot restore, you do not have a backup.
• Check storage location: Backups on the same server as your site are not safe. Store in at least two separate locations (cloud storage and offsite).
• Verify database completeness: Import the backup into a test database. Confirm all tables and critical data are intact.
• Document the restore procedure: Write a step-by-step runbook anyone on the team can follow. Time the process so you know if recovery takes 15 minutes or 4 hours.

Review our WordPress maintenance checklist for a complete backup schedule.

Security Headers Check and Configuration

HTTP security headers protect against XSS, clickjacking and MIME-type sniffing. They take minutes to implement, yet the majority of websites are missing critical headers.

• Content-Security-Policy (CSP): Defines trusted content sources. Prevents XSS by blocking inline scripts and unauthorized resources. Start with report-only, then enforce.
• X-Content-Type-Options: Set to nosniff. Prevents MIME-type sniffing that can turn uploaded files into executable code.
• X-Frame-Options: Set to DENY or SAMEORIGIN. Blocks clickjacking by preventing iframe embedding.
• Referrer-Policy: Set to strict-origin-when-cross-origin. Prevents leaking sensitive URL parameters to third parties.
• Permissions-Policy: Explicitly deny browser features your site does not use: camera=(), microphone=(), geolocation=()

Use SecurityHeaders.com to scan your domain. Most WordPress sites score D or lower out of the box. Aim for an A grade. For Apache, add headers in .htaccess. For Nginx, add them to your server block.

File Permissions and Database Security

Incorrect file permissions allow attackers to modify site files even with limited access. Review both files and database credentials during your audit.

• Directories: 755. Never 777 on any directory.
• Files: 644.
• wp-config.php: 600 or 640. This file contains database credentials and security keys.
• Uploads directory: Block PHP execution with php_flag engine off in .htaccess.

For database security: rotate the database password using a 32+ character random string and update wp-config.php accordingly. Restrict the WordPress database user to only the privileges it needs (SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, DROP). It should not have GRANT, FILE or SUPER privileges. Review access logs for connections from unexpected IP addresses. If your database accepts remote connections, restrict access to specific IPs or disable remote access entirely when the application and database share the same server.

Malware Scanning and File Integrity

Malware can sit undetected for months. Cryptominers, SEO services spam injections and backdoor shells operate quietly. A year-end scan catches infections daily monitoring may have missed.

• Full malware scan: Use Wordfence, Sucuri SiteCheck or MalCare. Compare core files against the official WordPress repository.
• Backdoor check: Search for PHP files in directories that should only contain images. Look for base64-encoded payloads, eval() calls and randomly named files.
• Cron job review: Check WP-Cron and server cron for unauthorized tasks. Attackers use cron to maintain persistence.
• File integrity monitoring: Use Wordfence or server-level tools like AIDE to alert on unexpected file changes.

Logging, Monitoring and Incident Response

You cannot respond to attacks you do not see. Verify your visibility layer is working:

• Access logs: Web server should log all requests with timestamps, IPs, methods and response codes.
• Error logs: Review for patterns indicating exploitation. Repeated 404s for admin paths, unusual POST requests and PHP fatal errors in unexpected locations are red flags.
• Login monitoring: Track failed attempts and alert on more than five failures from a single IP within 10 minutes.
• Uptime monitoring: External service (UptimeRobot, Pingdom) checking every 1-5 minutes with immediate alerts.
• Log retention: Minimum 90 days. Store logs off the web server where attackers cannot tamper with them.

Incident Response Plan Review

An incident response plan tells your team exactly what to do during a breach. Without one, breaches become panic. Your year-end audit should include updating this plan.

• Contact list: Developer, hosting provider, security consultant and legal contacts. Stored outside the potentially compromised server.
• Classification criteria: Define low, medium and high severity. Each level triggers a different response process.
• Containment steps: Taking the site offline, blocking IPs, changing credentials, revoking API keys. Written so someone can follow them under pressure.
• Evidence preservation: Snapshot the server and copy logs before cleaning anything.
• Communication plan: Who tells customers, partners and regulators. In Canada, PIPEDA requires notification for breaches involving personal information with risk of significant harm.
• Recovery procedure: Restore from clean backup, harden the entry point, verify attacker access is removed.

Run a tabletop exercise at least annually where your team walks through a hypothetical breach. Time each phase and update the plan based on gaps you find.

Frequently Asked Questions

Get a Professional Security Audit for Your Website

A year-end security audit protects your business, your customers and your reputation heading into the new year. Our security team reviews every layer from SSL configuration to server hardening and delivers a prioritized remediation report.

Call us at 604-901-7668 or fill out the form below to schedule your year-end security audit.

Want a quick assessment first? Request a free audit to identify the highest-priority issues in your current setup.