How to Run a WordPress Website Audit for Clients: A Step-by-Step Guide for Agencies

A good audit does three jobs for an agency. It shows a prospect what’s wrong with their current site, gives existing clients a plan they can budget for, and often leads straight into a redesign, a care plan or a speed project.

Below is the audit process we’d use: what to check, which tools help, and how to present the findings so the client actually acts on them.

Why audits work

An audit swaps opinions for evidence. “Your site feels slow” starts a debate. Showing the client their Core Web Vitals, the three plugins dragging the site down and the visitors they lose because of it starts a conversation about fixing it.

It’s also a low-risk first project with a new client. The scope is small and clear, and you get to show what you know before anyone signs up for something bigger.

Step 1: goals and access

Find out what the site is for: leads, sales, bookings, information. Ask what worries the client most. Then collect access:

• a WordPress admin account of your own, separate from the client’s;
• hosting or server access if you can get it;
• Google Search Console and Analytics;
• a list of the pages, forms and journeys that matter most.

Step 2: performance

Speed affects both conversions and rankings. Look at Core Web Vitals in PageSpeed Insights and in Search Console field data. Note page weight, image sizes and formats, and how many scripts and stylesheets each page loads. Check caching, the CDN and the server’s response time, and see whether the theme or page builder is the main source of bloat.

Write the numbers down so you can compare later. Our guide to Core Web Vitals for WordPress explains each metric.

Step 3: security and maintenance

It’s common to find client sites that haven’t been updated in months. Check core, theme and plugin versions. Look for abandoned plugins and nulled ones. Go through user accounts and roles, especially old admins. Ask where the backups are and whether anyone has ever restored one. Then check SSL, security headers and login protection.

Step 4: technical SEO

Look for anything stopping pages from ranking: pages accidentally blocked from indexing, broken links, redirect chains, missing or duplicate titles and meta descriptions. Check the heading structure, internal links, the XML sitemap and, where it makes sense, structured data.

Step 5: UX and conversion

A fast, secure site still fails if people can’t find what they came for. Walk through the main journeys on a phone and a laptop. Look at the calls to action, the forms, the navigation and the content structure. Check the accessibility basics: contrast, keyboard navigation and alt text.

Step 6: code and content structure

Last, look under the bonnet. Is the theme custom, a child theme, or a commercial theme that someone has edited directly? How is content organised: custom post types, fields, blocks? Can the client edit safely? Is there custom code nobody will want to maintain?

This step often decides whether to improve the site or rebuild it. Our article on WordPress website redesign helps with that call.

Step 7: turn findings into a plan

Nobody wants a forty-page list of problems. The client wants to know what matters and what to do next, so sort the findings by urgency.

Critical items come first: security risks, broken features, anything that costs money right now. Then the important ones, the performance, SEO and UX issues holding the site back. Everything else goes on a “later” list.

For each item, explain the problem in plain words, what it means for the business and how you’d fix it. Then turn the plan into offers the client can say yes to: a speed optimization project, a care plan or a custom theme rebuild.

Doing more audits without overloading the team

A proper audit takes real technical time. You can keep the client-facing part, the meeting and the recommendations, and hand the technical review to a white label partner who returns the findings in a format you can brand.

We do these reviews for agencies, and the fixes that follow. Send us the site you need audited.