Find The WordPress Security Gaps Hiding Between Core, Plugins, Users And Hosting
A WordPress website can be fully operational while quietly depending on too many administrator accounts, outdated or abandoned plugins, modified core files, untrusted theme code, unexpected scheduled jobs, weak privileged authentication, forgotten Application Passwords, unsafe file permissions, exposed configuration, inadequate backups, and poor logging.
WordPress's current security handbook explicitly treats security as a layered problem spanning passwords, filesystem permissions, database security, wp-admin, wp-config.php, plugins, backups, logging, and monitoring. Shrazen reviews those WordPress-specific layers together, validates important integrity and access assumptions, and turns the findings into a prioritized remediation roadmap.
Hidden Assumptions Threatening Your WordPress Installation
Most compromised WordPress sites pass routine plugin scans right until a critical intrusion occurs:
/wp-content/plugins//wp-includes/ or /wp-admin/backup.sql) or exposed wp-config.php backup copies/uploads/AUDIT THE WORDPRESS INSTALLATION — NOT JUST THE VERSION NUMBER
“A secure WordPress installation depends on the relationships between its layers. Shrazen audits WordPress as an application ecosystem—not as a single CMS version number.”
The WordPress Security Audit Shift
Why generic WordPress security plugin scans fail—and how holistic engineering posture audits protect your business.
1. Superficial Dashboard Scan
Runs within the same compromised PHP process, scanning only for known signatures in public directories.
2. Blind to Access & Identities
Cannot distinguish active administrators from former contractors, nor identify forgotten Application Passwords.
3. Ignores Hosting, Cron & Environment
Blind to server-level crons, neighboring sites on shared hosting, exposed database panels, and file permissions.
4. False Confidence & Scanner Noise
Shows a green "100% Secure" badge while critical architectural gaps, unverified backups, and backdoors remain.
1. Environment & Architecture Mapping
We map your full WordPress footprint: core, PHP runtime, database, web server, multisite, staging, and CDN layers.
2. Official Checksum & Provenance Verification
We verify WordPress core and eligible plugins against official WordPress.org checksums using WP-CLI tools.
3. Identity, Role & Programmatic Credential Audit
We audit all Administrator roles, Application Passwords, MFA enforcement, session salts, and user capabilities.
4. Configuration, WP-Cron & Execution Controls
We inspect wp-config.php, debug flags, file editor settings, uploads execution, and scheduled WP-Cron hooks.
5. Prioritized Roadmap Linking into Hardening
Clear risk prioritization (Critical / High / Medium) linking directly into WordPress security hardening.
Do not rely on a plugin scanner alone. Shrazen evaluates WordPress as an interconnected application ecosystem grounded in official WordPress Advanced Administration security guidelines and OWASP standards.
What Is A WordPress Security Audit?
A structured, multi-layered review of the controls, configuration, software, access permissions, and operational practices protecting a WordPress installation.
Complete WordPress Attack Surface
A comprehensive audit inspects every functional layer of WordPress:
- 🔍Core Integrity & Version BaselineWordPress core files, version supportability, and official WordPress.org checksum verification.
- 📦Plugins, Themes & Custom CodeActive/inactive software, source provenance, unmaintained extensions, child themes, and query safety.
- 👤Users, Privileges & Application PasswordsAdministrator inventory, role capabilities, MFA status, and programmatic API credentials.
- ⚙️wp-config.php & Filesystem PermissionsDatabase credentials, debug settings, file-editing controls, upload directories, and
mu-plugins. - ⏱️Scheduled Events, APIs & OperationsWP-Cron hooks, REST API routes, XML-RPC exposure, database exposure, logging, and backup restorability.
Shrazen Audit Standards
Evaluation methodologies aligned with authoritative WordPress & security frameworks:
- ★Official WP-CLI Checksum VerificationDirect cryptographic verification of core and eligible plugins against official repository hashes.
- ★WordPress Security Handbook AlignmentAuditing filesystem permissions, database security, and administrative configurations against official guidance.
- ★Database Query Parameterization AuditVerifying custom theme and plugin queries against
$wpdb->prepare()best practices. - ★Contextual Risk PrioritizationEvaluating real business impact, reachability, and compensating controls rather than raw CVE counts.
- ★Remediation Implementation PathSeamless transition to WordPress hardening and backup setup.
The core principle: A clean malware scan does not mean WordPress is secure. An audit reveals which controls are actually working and which assumptions have never been verified.
How Shrazen Audits WordPress Security
We execute 5 specialized engineering workflows to verify integrity, evaluate access, inspect execution controls, and test operational resilience.
Core & Extension Integrity Verification
We verify the integrity and provenance of WordPress core files, installed plugins, and active themes against trusted upstream repositories.
- Running official
wp core verify-checksumsagainst WordPress.org repository hashes - Validating eligible plugin checksums and investigating unexpected file differences
- Cataloging all plugins by version, activation state, maintenance status, and business purpose
- Inspecting custom themes for query safety (
$wpdb->prepare) and CSRF nonce handling
Identity, Access Roles & Application Passwords
We audit all user accounts, administrative privileges, authentication controls, and programmatic credentials linked to the WordPress environment.
5 Administrator accounts, including former developers and retired Application Passwords active with full REST access
Shrazen Audit Standard:Enforcing least privilege, removing dormant admins, revoking obsolete Application Passwords, and auditing MFA enforcement
- Enumerating all users and validating business necessity for Administrator and Editor roles
- Auditing WordPress Application Passwords for active programmatic credentials
- Reviewing authentication mechanisms, password policies, MFA enforcement, and login rate limiting
- Evaluating session management, logout behavior, and authentication salt configurations
Configuration, Filesystem & Upload Execution Security
We inspect configuration constants, server file permissions, upload directory protections, and special WordPress directories.
- Auditing
wp-config.phppermissions, database credentials, and production debug flags - Checking dashboard code editing controls (
DISALLOW_FILE_EDIT) - Evaluating filesystem permissions across
/wp-content/,/uploads/, and root - Inspecting
mu-pluginsand drop-in files for undocumented executable code
Execution Surfaces, WP-Cron & API Exposure
We evaluate background execution hooks, REST API routes, XML-RPC exposure, and database administration boundaries.
- Listing and auditing all scheduled WP-Cron hooks and recurring callback functions
- Inspecting custom REST API routes for proper
permission_callbackauthorization checks - Evaluating XML-RPC attack surface and determining if the interface is required by business logic
- Reviewing database exposure, admin panels (phpMyAdmin), and public backup file presence
Operational Resilience, Logging & Backup Restorability
We audit whether the WordPress environment captures meaningful security events and maintains restorable disaster recovery backups.
- Reviewing security event logging: privileged logins, user creation, plugin changes, and failures
- Ensuring sensitive secrets, tokens, and passwords are not leaked into debug log files
- Auditing backup completeness (database + files), retention cycles, and offsite storage separation
- Evaluating proven restorable validity with backup restoration testing
Tailored WordPress Security Audit Scenarios
Specialized audit frameworks engineered for distinct WordPress architectures and business models.
WooCommerce & High-Volume Store Audit
Auditing customer accounts, checkout session isolation, payment gateway webhooks, API tokens, and order database security against skimming and data exposure.
- Checkout & webhook validation
- Customer data & order isolation
- Payment plugin credential safety
- WooCommerce Hardening →
Post-Compromise & Malware Recovery Audit
Following malware cleanup or hack recovery, we conduct an exhaustive posture audit to identify root-cause entry points and ensure no latent backdoors survive.
- Root-cause intrusion analysis
- WP-Cron & backdoor persistence
- Salt & credential rotation
- WP Hack Recovery →
WordPress Multisite Network Audit
Evaluating network-wide Super Administrator accounts, network-activated plugins, shared theme vulnerabilities, and cross-site tenant boundaries.
- Super Admin access governance
- Network-activated plugin CVEs
- Per-site upload isolation
- Vulnerability Assessment →
Custom Theme & API-Driven Headless WordPress
Inspecting custom child theme functions, custom REST API endpoints, OAuth / JWT tokens, GraphQL schemas, and headless frontend communication.
- REST
permission_callbackchecks - Dynamic SQL & query parameters
- Application Password governance
- Website Security Audit →
WordPress Security Plugin vs Shrazen Security Audit
Why security plugins cannot replace a complete engineering evaluation of your WordPress ecosystem.
| Audit Dimension | Standard WordPress Security Plugin | Shrazen Comprehensive WordPress Audit |
|---|---|---|
| Core File Verification | Local file scan; may miss core modifications if plugin is compromised | Cryptographic WP-CLI comparison against official WordPress.org checksums |
| Plugin & Theme Provenance | Checks version numbers; unaware of custom modifications or source trust | Evaluates source provenance, business necessity, and repository integrity |
| Identity & Roles | Lists users; blind to whether former contractors still hold Admin roles | Validates every privileged role, removes unnecessary accounts, checks MFA |
| Application Passwords | Often completely ignored in standard plugin scan reports | Audits all programmatic credentials, identifying retired integration tokens |
| WP-Cron & Scheduling | Does not analyze scheduled event hooks for unauthorized recurring logic | Enumerates WP-Cron hooks and maps recurring callbacks to known code |
| Configuration & Filesystem | Basic file check; cannot evaluate custom hosting permission architecture | In-depth audit of wp-config.php, debug flags, mu-plugins, and file permissions |
| Backups & Disaster Recovery | Displays "Backup Created"; never tests actual restorable validity | Evaluates offsite separation, retention cycles, and proven restore capability |
What We Audit Across Every WordPress Layer
Rigorous security evaluation spanning every tier of your WordPress architecture.
WordPress Core & Integrity
Auditing installed core version, supportability, WordPress.org checksums, and unexpected executable files in /wp-includes/ and root.
Plugins, Themes & Supply Chain
Inventorying active and inactive extensions, checking checksums, flagging abandoned or nulled software, and inspecting theme nonces.
Users, Roles & Application Passwords
Auditing all Administrator identities, least-privilege role mappings, MFA enforcement, session salts, and programmatic API credentials.
Configuration, Filesystem & Uploads
Reviewing wp-config.php, debug flags, file-editing controls, upload directory PHP execution limits, and mu-plugins.
WP-Cron, REST APIs & Database
Inspecting scheduled cron hooks, REST endpoint permission callbacks, XML-RPC exposure, database credentials, and public backup files.
Backups, Logging & Recovery Readiness
Evaluating security event logging, debug log secrets exposure, backup storage independence, and disaster recovery restorable validity.
The Shrazen WordPress Security Audit Process
A structured 4-step engineering protocol designed to map, verify, prioritize, and roadmap your WordPress security improvements.
Scope & Architecture
Discovery & Mapping
- Identify production & staging sites
- Document PHP, server & database
- Catalog all plugins & themes
- Map external APIs & integrations
Verify Core & Access
Testing & Inspection
- Run WP-CLI core checksum tests
- Verify eligible plugin checksums
- Audit Administrators & roles
- Inspect Application Passwords & MFA
Config, Cron & Ops
Configuration & Execution
- Inspect
wp-config.php& debug flags - Audit WP-Cron scheduled hooks
- Review upload directory permissions
- Test backup restorable validity
Prioritized Roadmap
Actionable Deliverable
- Deliver Executive Summary
- Document evidence-based findings
- Categorize risk (Critical/High/Med)
- Bridge to security hardening
Interactive WordPress Security Audit Simulator
Simulate how Shrazen audits WordPress core checksums, inspects privileged accounts & Application Passwords, and tests WP-Cron & backup restorability.
[WP-CLI INTEGRITY AUDIT] Running core and extension validation...
- WordPress Core Checksums:
wp core verify-checksums-> PASS (1,842 files match WordPress.org hashes). - Plugin Inventory: 39 installed plugins: 30 active, 9 inactive. 3 inactive plugins have no business purpose and contain unpatched CVEs.
- Plugin Integrity Mismatch:
/plugins/vendor-tool/handler.phpfailed checksum verification due to manual unversioned code edits.
[IDENTITY & CREDENTIAL AUDIT] Inspecting privileged WordPress accounts...
- Administrator Inventory: 5 Administrator accounts discovered. 2 belong to a marketing agency offboarded 8 months ago.
- Application Passwords: 1 active programmatic credential named "Zapier_Sync_2023" remains active on an admin account.
- Privileged MFA: Multi-Factor Authentication is NOT ENFORCED on administrator logins.
[CONFIGURATION & OPERATIONAL AUDIT] Inspecting execution & recovery readiness...
- wp-config.php:
WP_DEBUGis enabled on production, logging database queries to publicdebug.log. - WP-Cron Events: 14 scheduled hooks inspected. Hook
sync_stock_custommapped to legitimate inventory script. - Backup Restorability: Daily backup plugin runs locally on server; offsite storage missing, 0 restore tests ever conducted.
Real-World WordPress Risk Gaps
Dormant Privileged Accounts
Old administrator accounts and forgotten Application Passwords allow bypass of standard login boundaries.
Unnecessary Inactive Plugins
Unused extensions remain directly reachable on disk, exposing unpatched CVEs to automated exploit bots.
Untested Backup Copies
Backup plugins report "Success" while storing archives on the same server without verified database restorable tests.
Audit Your WordPress Installation
Uncover critical access vulnerabilities and operational risks with an exhaustive Shrazen engineering review.
Request WordPress Security AuditComplete WordPress Security Audit Checklist
The comprehensive evaluation framework Shrazen applies to every WordPress installation.
WordPress Core
- Installed core version identified & updates reviewed
- Official WP-CLI checksum verification executed
- Unexpected files in
/wp-admin/&/wp-includes/reviewed - Core modification provenance documented
Plugins & Themes
- Complete active & inactive plugin inventory mapped
- Software source provenance & nulled packages reviewed
- Eligible WordPress.org plugin checksums verified
- Theme nonces, forms & custom code safety reviewed
Users & Authentication
- All Administrator & Editor identities justified
- Former contractors & agency accounts audited
- MFA enforcement across privileged accounts verified
- Password strength policies & brute-force limits checked
Application Passwords
- All active Application Passwords cataloged
- Programmatic credential business purpose validated
- Retired integration credentials flagged for revocation
- REST API authentication pathways audited
Configuration & Filesystem
wp-config.phplocation, permissions & constants audited- Production debug flags (
WP_DEBUG) verified safe - File editing (
DISALLOW_FILE_EDIT) configuration reviewed - Upload directory PHP execution boundaries tested
Execution, Cron & Database
- Scheduled WP-Cron hooks enumerated & mapped
- REST API custom routes & permission callbacks reviewed
- XML-RPC business necessity evaluated
- Database exposure & public
.sqldumps audited
Backups & Recovery
- Database & filesystem backup completeness verified
- Offsite storage isolation & retention cycles audited
- Controlled backup restore validity tested
- Incident response escalation procedures reviewed
Logging & Monitoring
- Privileged login & setting change logging audited
- Debug log secrets & token leakage reviewed
- File integrity monitoring visibility assessed
- Post-incident forensic readiness documented
Real-World WordPress Security Audit Example
How a comprehensive Shrazen security audit revealed hidden risks on a seemingly healthy WooCommerce store.
1. Core Integrity
WP-CLI core checksum verification passed across all 1,842 files. Core is authentic.
2. Plugin Inventory
39 plugins installed, 9 inactive. 3 unneeded plugins contained known CVE exploits.
3. Plugin Integrity Diff
Vendor plugin failed checksums due to unversioned custom code modifications inside plugin files.
4. Dormant Admins
5 Administrator accounts; 2 belonged to former agency contractors no longer associated with the business.
5. Application Passwords
Admin account contained an active Application Password for an automation tool retired 8 months prior.
6. WP-Cron Validation
Unexplained 5-minute recurring hook mapped to legitimate inventory sync script. No security issue.
7. Backup Restorability
Daily backups stored only on local server; zero restore tests ever conducted.
8. Logging Visibility
Privileged logins and settings modifications lacked auditable logging records.
Delivered Remediation Roadmap
Why Choose Shrazen For WordPress Security Audits?
We treat WordPress as an application ecosystem—delivering evidence-based evaluations rather than scanner noise.
WordPress-Specific Integrity Testing
We utilize official WP-CLI tooling to cryptographically verify WordPress core and eligible plugins against official WordPress.org checksums, distinguishing genuine updates from unauthorized file modifications.
Privileged Identity & Role Review
We conduct thorough inventory of Administrator accounts, Editor permissions, and custom role capabilities, ensuring strict enforcement of the least-privilege principle across all operational teams.
Application Password Governance
WordPress now features a mature programmatic credential model through Application Passwords. We inspect all active programmatic credentials and flag undocumented or retired integration tokens.
WP-Cron & Background Execution Analysis
Scheduled WordPress execution is vital for operations—but can also serve as a backdoor persistence channel. We enumerate all scheduled hooks and map callback functions directly to verified code.
Deep Configuration & Environment Depth
We inspect wp-config.php constants, database privileges, upload directory PHP execution limits, mu-plugins, drop-ins, and hosting account isolation to evaluate the complete operating environment.
Disaster Recovery & Restorable Validation
Security posture includes recovery capability. We audit backup frequency, offsite storage independence, encryption, and whether backups can reliably restore the site in an emergency.
Zero Security Theatre
We do not treat cosmetic changes—such as renaming table prefixes or hiding login URLs—as substitutes for real security controls. We prioritize authentication, software provenance, and permission hygiene.
Evidence-Based Reporting
Every finding includes the affected WordPress layer, concrete proof-of-concept evidence, contextual business impact, risk severity ranking, and actionable remediation steps.
WordPress Security Audit FAQ
Authoritative answers to common questions about WordPress security assessments, checksums, credentials, and recovery.
What is a WordPress security audit?▼
wp-config.php, filesystem permissions, uploads, WP-Cron scheduled events, database exposure, backups, logging, and hosting configuration.Is a WordPress security audit the same as a malware scan?▼
What is the difference between a WordPress security audit and a website security audit?▼
wp-config.php hardening.What is the difference between an audit and WordPress security hardening?▼
Does the audit verify WordPress core files with official checksums?▼
wp core verify-checksums tooling to compare every installed core file against the cryptographic hashes published by WordPress.org for that specific version.Does a core checksum mismatch automatically mean my site was hacked?▼
Can WordPress plugin files be checksum-verified?▼
Are inactive plugins a genuine security concern?▼
What are WordPress Application Passwords, and why are they audited?▼
Does the audit review scheduled WP-Cron events?▼
Does changing the database table prefix make WordPress secure?▼
wp_ to a custom prefix provides only minor security-through-obscurity against basic automated bots. It does not protect against SQL injection, broken authentication, or vulnerable plugins. WordPress's own documentation emphasizes substantive security controls over table prefix obscurity.Does changing the WordPress admin login URL secure the site?▼
Can you audit WooCommerce stores?▼
Can you audit WordPress Multisite networks?▼
Does the audit verify whether backups can actually be restored?▼
Should I audit WordPress after a hack or malware infection?▼
WordPress Security Is More Than Keeping Core Updated
A WordPress installation is a connected system spanning core integrity, plugins, themes, user roles, Application Passwords, wp-config.php, filesystem permissions, WP-Cron, database security, backups, logging, and hosting.
Which parts of your WordPress installation are trusted, which controls are actively protecting it, and which assumptions have never been verified?