Skip to content
support@hexweb.net
Gen. Skobelev 24, Kazanlak, Bulgaria, EU

13-Point WordPress Check

Your free website audit,
in plain English.

Send us your URL and we will run a free website audit — eight checks need nothing but the address, and five more need a read-only login if you want them included. Either way you get a plain-English report on what is out of date, slow, or quietly broken. No card, no obligation, no call to sit through first.

Report within three working days · 500+ WordPress projects maintained since 2018.

WordPress websites reviewed by Hexweb during a free website audit

01 / What you cannot see

Most website problems are invisible until they are expensive.

Nothing on your site announces that a plugin stopped receiving security patches, that last night's backup silently failed, or that your order confirmations are landing in spam. You find out when a customer tells you — which is the worst possible moment and the most expensive.

See our maintenance plans
Security
Now

You do not know which plugins on your site have published vulnerabilities, or which have been abandoned by their developers and will never be patched.

After

You have a ranked list: what is exposed, what is unmaintained, and which items need action this week rather than this quarter.

Performance
Now

Your site feels slow on a phone, but nobody can tell you whether that is the images, the hosting, the theme, or one badly behaved plugin.

After

You have real Core Web Vitals numbers for mobile and desktop, and the specific cause behind each measurement that fails.

Recovery
Now

You have backups. Probably. Nobody has ever tested whether they would actually restore, or how much work you would lose if they did.

After

You know where your backups live, how old the newest one is, and whether restoring from it would genuinely bring the site back.

02 / Our approach

What a free website audit actually covers.

Automated scanners hand you three hundred findings and rank none of them. That is not an audit, it is a wall of red. We run the measurements where machines are reliable, then a person reads the results and tells you which three things matter.

01

A person reads it, not just a tool

Every finding is triaged by severity and by what it actually costs you — so you know what to fix first.

02

Written to be understood

No jargon wall. Each item says what is wrong, what it means for your business, and what fixing it involves.

03

Yours to act on without us

Hand the report to any developer, or work through it yourself. There is no lock-in and nothing is withheld.

04

We check what tools skip

Backup restorability, transactional email deliverability, and whether Google can actually reach your pages at all.

03 / The checklist

Eight checks from your URL. Five that need a login.

We would rather be straight with you about this than promise thirteen checks and quietly deliver eight. Some things simply cannot be seen from outside a website — and anyone who tells you otherwise is guessing. Performance is measured against Google's Core Web Vitals thresholds, not against how the site feels on the day.

From your URL alone — nothing else needed

01 · Core Web Vitals
LCP, CLS and INP measured on mobile and desktop rather than estimated.
02 · Page weight & images
Uncompressed and legacy-format images adding load time to every page.
03 · SSL & security headers
Certificate validity, HTTPS redirects, and the response headers you are missing.
04 · Titles & meta descriptions
Missing, duplicated, or cut off halfway through in search results.
05 · Image alt text coverage
How much of your imagery is invisible to search engines and screen readers.
06 · Internal linking & orphans
Pages with no route in from your own navigation — invisible to visitors and crawlers alike.
07 · Indexing & crawlability
Your robots.txt, XML sitemap, canonicals and meta robots — what you are telling Google it may read.
08 · Email authentication
Your SPF, DKIM and DMARC records, read from public DNS — the usual reason mail lands in spam.

With a read-only login — optional, and you can decline

09 · Full plugin & theme inventory
Every plugin and version, not just the few that happen to load a file on your homepage.
10 · Known vulnerabilities
Your real plugin set matched against published security advisories.
11 · PHP version & error log
Whether your server runs a supported version, and what is failing silently in the background.
12 · Backup status
Where backups actually live, how recent they are, and whether they would genuinely restore.
13 · Order & enquiry email delivery
Not just whether the records are right — whether the message actually arrives.

Why the split matters: we tested this. Probing a live WordPress site from the outside identified one of its five active plugins, no reliable version numbers, and no PHP version at all. The plugin it missed was the backup plugin. That is why backup status, vulnerability matching and mail delivery sit in the second list — not because we are holding them back, but because no external tool can honestly report on them.

Request your audit

Send us
your URL.

That is all we need to begin. We will confirm by email, run the eight external checks, and come back within three working days. If you want the other five, we will ask for a read-only login separately — and the report is yours either way.

Cost
Free, with no obligation
Turnaround
Within three working days
You receive
8 checks minimum, ranked by priority
Best suited to
WordPress sites over a year old
Prefer to talk first?
Book a free 30-minute call.
Schedule
Report within three working days · No obligation

04 / How it works

How it works — about two minutes of your time.

8
Checks from your URL alone
3
Working days to your report
01

You send your URL

One field. If you already suspect something specific is wrong, tell us and we will start there.

02

We run the checks

Eight from the outside straight away. If you granted a read-only login, the other five as well — then a person reads every result.

03

You get the report

A plain-English summary within three working days: what is urgent, what can wait, and what is genuinely fine.

04

You decide what happens next

Fix it yourself, pass it to your developer, or ask us to handle it. All three are perfectly good outcomes.

Close-up of a laptop keyboard representing a website audit in progress

05 / FAQ

Questions,
answered.

Yes. There is no card, no trial, and no call you have to sit through first. Send the URL, get the report. We offer it because it is the most honest way we know to start a conversation — and the report is yours either way, whether you bring us in or hand it to your own developer.

Your website address is enough for eight of the thirteen checks — Core Web Vitals, images, security headers, titles, alt text, internal linking, indexing and crawlability, and email authentication. The other five need a read-only login to your WordPress admin or hosting. That is not us being awkward: your full plugin inventory, your backup status and whether mail actually arrives genuinely cannot be determined from outside. We tested it — an external probe of a live site found one of its five plugins and missed the backup plugin entirely. You can decline access and still get the eight-check report.

We aim to send the report within three working days. If your site is unusually large or we hit something that needs digging into, we will tell you rather than quietly running late.

The thirteen-point check is built around WordPress, which is what we have specialised in since 2018. We will still look at a Shopify, Squarespace or custom site, but several checks — plugin vulnerabilities, core version, staging behaviour — will not apply, so you get a shorter report.

Straight answer: if the audit shows your site needs ongoing attention, we will say so and point you at our WordPress maintenance plans. If it does not, we will say that instead. What we will not do is manufacture urgency — the findings are what they are, and you can act on them without us.

Then the report says so, and you have spent nothing to gain the certainty. That is a genuinely useful outcome. It happens most often with sites that were built recently and have been actively looked after since.

Find out what is wrong before your customers do.

Request your free website audit and we will tell you exactly where your site stands — security, speed, backups and the rest — in language you can act on. If you would rather talk it through first, book a call instead.

Report within three working days · No obligation.