WordPress self-check: 10 things you can look at in 15 minutes

Most of what we find on small-business WordPress sites is visible from outside. You can check it yourself with a browser and your WordPress login. If something on this list turns up, it isn't proof of a break-in. It's a door worth closing.

From any browser (no login needed)

  1. Open yoursite.com/wp-content/debug.log. If it loads, your error log is public. Set WP_DEBUG_LOG to false in wp-config.php and delete the file.
  2. Open yoursite.com/wp-content/uploads/. If you see a list of folders, directory browsing is on. Ask your host to turn it off, or add "Options -Indexes" to .htaccess.
  3. View the page source and search for "noindex". If it's on your homepage, Google is being asked to skip the site.
  4. Search the source for "UA-". If that's your only analytics tag, nothing has been recorded since July 2023. Set up GA4.
  5. Put your address into PageSpeed Insights on mobile. If the main content takes longer than 2.5 seconds, visitors on phones feel it.

Inside WordPress

  1. Plugins screen: update anything with an update waiting, starting with security, cache, SEO, backup and form plugins. Delete the ones you've switched off.
  2. Users screen: every Administrator should be someone you know by name. Remove the rest, or ask them.
  3. Tools > Site Health: note the PHP version and ask your host whether it has the latest security patch.
  4. Check your backups actually restore. A backup nobody has tested is a guess.
  5. Settings > Reading: make sure "Discourage search engines" is unticked.

Stuck on any of these? Run the free scan at crawlcare.com and reply to the report email. We'll tell you what we see.

Email me this list?

Yes, we'll send it. Pop your email in, click the confirm link we send you, and the same 10 checks land in your inbox right after. You'll also get the weekly CrawlCare newsletter: one or two practical website fixes, nothing more. It's optional and you can unsubscribe any time.