WordPress Core
Version, core file integrity, and exposure of sensitive information in the configuration.
Security audit
WordPress security audit
A deep review of your installation following the OWASP methodology, the reference standard for auditing web applications. By the end, you will know what is wrong with your site, which issues are genuinely serious, and in what order to fix them.
Reviewed by hand, not just scanned
Report with priorities
Attack surface I review
Admin panel
Admin panel
Exposure with no extra protection, resistance to brute force, user enumeration, and lack of two-factor authentication.
API endpoints
API endpoints
XML-RPC enabled by default on many installs, and WordPress REST API endpoints that can expose users or content without authentication.
Forms and file uploads
Forms and file uploads
Testing for injected scripts, database injection, and code execution through forms or upload areas.
Server configuration
Server configuration
Security headers, permissions on sensitive files like wp-config.php, and direct access to folders that shouldn't be reachable.
Roles and users
Roles and users
Admin users identifiable from outside, inactive accounts with elevated privileges, and password policy.
My approach
An audit isn't running a scanner and forwarding you its report
01
Tests done by hand
A scanner finds the obvious. What an attacker really exploits usually lies in how your site works under the hood.
02
On your actual configuration
Every finding is verified on your specific installation, not against a template of generic issues.
03
With priority, not just a list
Every issue comes with its real risk written down and the order in which to fix it.
Why this isn't optional
Nearly half of WordPress sites are affected by a vulnerability caused by an outdated or poorly coded plugin or theme, and around 40% of hacked sites were running unpatched software at the time of the attack. If you also handle customer data or payments, a security breach can trigger a mandatory incident notification under GDPR, with fines that regulation sets as high as €20 million or 4% of annual turnover, whichever is greater.
What I check, area by area
Plugins and themes
Checking for known vulnerabilities in everything installed, even deactivated items, and detecting injected code or backdoors.
Access and roles
Admin users, role review, and exposure of the access point.
WooCommerce
Payment data protection, encryption configuration, and store-specific vulnerabilities.
Server and hosting
File and folder permissions, security headers, and exposure of unnecessary endpoints.
Two scopes, depending on your setup
Essential review
The most common and most serious issues, the ones covered by the OWASP Top 10.
Essential review
The most common and most serious issues, the ones covered by the OWASP Top 10.
- Authentication and sessions
- Input validation
- Exposed server configuration
Full review
Everything above, plus advanced configuration, role-based permissions, and business logic.
Full review
Everything above, plus advanced configuration, role-based permissions, and business logic.
- Role-based access control
- Private areas and customer zone
- Business logic: payments, discounts, orders
How the audit is done
We define the scope based on your site
I review each agreed area by hand
I document every finding with its real risk
I hand you the report ordered by priority
Not sure whether you need the essential or full review?
What a security audit is not
It's not running an automated tool and forwarding you its report. Nor is it a list of generic warnings where most don't apply to your case and you have no way of knowing which ones do. It's an orderly review, with tests done by hand on your specific site, and a report where every issue comes with its real risk written down and what to do to fix it.
What you get
A plain-language summary of your real situation
The state your site is in and your real risk, no jargon. Two pages.
Technical detail for every issue — where it is and how to fix it
Every issue, where it is, how it can be exploited, and how to fix it.
Priority order: what to fix first and what can wait
The ordered list of what to fix first and what can wait.
Who audits
I'm Javier Afan, and I review every audit myself
WordPress developer with agency experience, specialised in security. I apply the OWASP methodology because it's the recognised standard for auditing web applications, not because it comes from an automated report — every finding is one I verify myself on your installation.
Manual tests, not just a scanner
Report with real priority, not a flat list
You talk to me directly
I explain every finding with no jargon
Contact
Tell me about your site
Tell me if it's a company site, a store, whether it has a customer area, and if it's had problems before. With that I can tell you which review fits and what it would cost.
Direct contact
[email protected]
Frequently asked questions
About the audit
What's the difference from a free scanner?
A scanner finds the obvious and generates generic warnings. I test by hand on your specific site and tell you which of those warnings are a real risk for you.
Is this only for big companies?
No. It makes sense for any site that handles customer data, payments, or a private area, whatever its size.
Which of the two do I need?
If you've never reviewed your site's security, the essential review is a good starting point. If you have a store or customer area, the full review usually makes more sense. If you're not sure, we can talk it through first.
Do you fix the issues you find?
The report includes how to fix every issue. If you'd like me to apply the fixes directly, we discuss it as a separate job.
Could something break while you review it?
Tests are carried out carefully so as not to affect your site's operation. If a specific case requires testing something more sensitive, I'll let you know beforehand.
What isn't audited doesn't stop being vulnerable
The sooner you know where the issues are, the sooner you can decide what to do about them.