What a Real WordPress Site Assessment Covers (and Why a Plugin Scan Isn't One)
A prospective client forwarded us a "WordPress audit" last year. It was a one-page PDF from a security plugin: a green checkmark next to "no known malware," a list of out-of-date plugins, and a recommendation to upgrade to the vendor's premium tier. The site, the report concluded, was healthy.
Three weeks later the site went down for the better part of a business day. The cause wasn't malware. It was a caching plugin and a page builder fighting over the same hook after an unattended update — exactly the kind of failure a scanner is structurally incapable of seeing. The "audit" had checked whether anything was currently on fire. It never asked whether the building was built to code.
That gap — between a scan and an assessment — is the single most expensive misunderstanding we see in WordPress operations. If you're a CTO inheriting a WordPress estate, a marketing leader staring down a replatform, or a founder who just signed another renewal with an agency you're not sure is earning it, it's worth being precise about what a real assessment is. Because the cheap version isn't a discount on the real thing. It's a different thing wearing the same name.
Why this keeps happening on WordPress specifically
WordPress runs roughly 43% of all websites on the internet and close to 60% of every site built on a recognized CMS. That dominance is the platform's great strength and the source of its most underestimated risk. The core is mature, heavily reviewed, and genuinely hard to break — in 2024, Patchstack catalogued 96% of new WordPress vulnerabilities in plugins and 4% in themes, with effectively none of consequence in core itself.
Read that number again, because it reframes the whole problem. The risk on a WordPress site almost never lives in WordPress. It lives in the dozens of third-party plugins and the theme — the parts a typical site owner bolts on without a second engineer ever reviewing the code. WordPress's extensibility is why a non-technical team can stand up a capable site in an afternoon. It's also why the average site accumulates an attack surface no one is accountable for.
And the clock is no longer forgiving. Patchstack's 2026 report found the median time from a high-impact vulnerability being disclosed to mass exploitation in the wild was about five hours, with 45% of heavily exploited bugs hit within 24 hours. "We update plugins monthly" used to be diligence. Against a five-hour exploitation window, it's a calendar invitation for an attacker.
This is the context a one-time plugin scan ignores. A scan tells you about known problems on the day it ran. An assessment tells you whether your site is architected and operated to survive the problems that haven't been disclosed yet.
What a real assessment actually covers
When we assess a WordPress site, we work from an internal checklist that runs past 200 individual checks across ten surfaces — analytics, security, site speed, SEO, branding, UX, automation, social, development practices, and content. We don't hand a client 200 red and green dots; a list that long is noise, not insight. The job of an assessment is to find the handful of those checks that, for this site, are quietly costing the business money. A few of the surfaces that consistently separate a healthy site from a fragile one:
Security posture, not a malware snapshot. A scan asks "is this site infected today?" An assessment asks the questions that determine whether it will be infected next quarter: Are backups automated and restorable — has anyone actually performed a recovery, or is the backup an untested assumption? Is there a real update discipline, or do plugins drift until something breaks? Who has administrator access, and why does a former contractor still have an FTP account? Are file permissions, SSL, and the database hardened, or default? Hosting won't save a site here — Patchstack found traditional hosting defenses blocked only 12% of known exploited-vulnerability attacks in their testing. Security on WordPress is an operating practice, not a plugin you install once.
Performance against the metrics Google actually scores. "The site feels fast on my laptop" is not a measurement. Google publishes specific Core Web Vitals thresholds — Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, Cumulative Layout Shift under 0.1 — and page experience is part of how pages are ranked. A real assessment measures the site against those numbers on real pages, then traces why it misses: an un-tuned caching layer, uncompressed images, a render-blocking script chain, a database that's never been optimized on an aging site. The fix is rarely "install a speed plugin." It's finding which of a dozen possible causes is the actual one.
SEO technical health — the plumbing, not the keywords. Is the site even discoverable? We've opened audits to find "Discourage search engines from indexing this site" still checked from a staging environment, silently deindexing a live business. Sitemaps submitted and clean in Search Console, a coherent redirect strategy instead of a graveyard of 404s, proper heading hierarchy, schema markup, canonical URLs — this is the technical substrate that determines whether good content ever gets a chance to rank. It's invisible to a marketing team and invisible to a security scanner, which is exactly why it rots.
Maintainability and development practice. This is the surface no scanner has a column for, and the one that predicts a site's future better than any other. Is there a staging environment, or are changes made live? Is custom code in a child theme and version-controlled, or jammed into functions.php where the next theme update will erase it? How many of the active plugins are abandoned by their authors? A site can pass every security and speed check today and still be a liability because it's built in a way that guarantees the next change breaks something. Assessing maintainability is assessing risk you haven't paid for yet.
Measurement that's actually trustworthy. Most "we track everything" setups are quietly broken — analytics firing twice, no conversion goals defined, internal office traffic inflating every number, campaign tagging absent so no channel can be attributed. If the data layer is wrong, every decision built on it is wrong. An assessment validates that the numbers a team is steering by are real before anyone optimizes against them.
The pattern most audits miss
Here's the thread that connects all of it, and the reason we'll argue with anyone selling a one-time scan as an audit: on WordPress, the dominant risk is operational, not point-in-time. The vulnerabilities live in third-party code you didn't write, the exploitation window is measured in hours, and the failures that take a site down are usually interactions between components that each looked fine in isolation.
A scan is a photograph. It can be useful — but a photograph of a healthy-looking patient tells you nothing about their cholesterol. What protects a WordPress site is the equivalent of ongoing care: a real update cadence, tested recovery, monitored Core Web Vitals, a staging-and-version-control workflow, and someone accountable when a plugin author goes dark. We've seen this pattern across medical-spa sites, law firms, property managers, and B2B operators for over a decade, and it holds regardless of industry. The sites that stay healthy aren't the ones that got the cleanest scan. They're the ones where someone owned the operating discipline.
That's also the honest reason the cheap audit is so common: a scan can be automated and sold at volume, while a real assessment requires an engineer to read the site the way the next engineer to touch it will have to. One is a product. The other is judgment.
What to ask for
You don't need to commission a full assessment to raise your standards. The next time someone offers you a WordPress "audit," ask three questions:
- Does it test recovery, or just note that backups exist? An untested backup is a hope, not a control.
- Does it measure performance against Google's published Core Web Vitals thresholds on real pages — or just give the site a vague "fast" rating?
- Does it evaluate how the site is built and maintained — staging, version control, child themes, plugin ownership — or only what's running right now?
If the answer to all three is no, you were sold a scan. That might be all you need this quarter. Just don't mistake it for knowing whether your site is sound.
Facet Interactive has spent over fifteen years building and operating enterprise WordPress sites on open-source foundations, and assessment is where most of our engagements begin — because you can't responsibly manage a site you haven't honestly evaluated. If you're inheriting a WordPress estate, planning a replatform, or simply unsure whether last year's "audit" actually told you anything, we're happy to take a real look.
