There’s a specific feeling to opening a new audit: you already know most of what you’ll find. Not because sites are identical, but because neglect has patterns. Across the hundreds of sites we’ve audited, from solo practices to eight-figure stores, these ten findings show up so consistently that we check them in this exact order.
Read this as a self-audit checklist. Every item includes what we find, why it happens, and what fixing it involves.
1. Outdated plugins (found on roughly 4 of 5 sites)
The most common and the most dangerous. Not one version behind (that’s normal life), but plugins 12+ months stale, often including ones with publicly documented vulnerabilities. This is the finding behind the industry’s ugliest number: 91% of the new WordPress vulnerabilities Patchstack counted in 2025 were in plugins. The fix isn’t heroics. It’s a monthly update routine with staging tests (the checklist is here).
2. Mobile speed failing while desktop passes
Owners check their site on an office computer over fiber and conclude it’s fast. Their customers open it on a phone in a parking lot. The majority of sites we audit pass desktop Core Web Vitals and fail mobile, which is the version Google actually ranks. If you check one thing after reading this, check your mobile scores.
3. Admin accounts nobody can explain
Ex-employees, former agencies, a freelancer from 2021, accounts named ‘admin’ or ‘test’ with full privileges and passwords of unknown quality. Every one is an unmonitored door. The fix takes ten minutes: list users, delete or downgrade everyone who doesn’t currently need access, and require 2FA on what remains.
4. Backups that exist in theory
Almost everyone believes they have backups. Under questioning it degrades fast: the backup plugin errored out silently months ago, backups save to the same server they’re meant to protect, or nobody has ever once tested a restore. A backup you haven’t restored is a hope, not a backup.
5. Forms delivering to nowhere
This one hurts to find: contact forms whose notification emails go to a dead inbox, land in spam because the site sends unauthenticated mail, or fail silently after a plugin update. On lead-generation sites this is direct revenue loss with zero symptoms. Test every form on your site this week, and route notifications through an authenticated email service.
6. The plugin graveyard
Deactivated plugins from experiments past: page builders that lost the bake-off, three SEO plugins from three different eras, sliders nobody remembers installing. Deactivated code is still attackable code sitting on the server, and it still gets flagged in vulnerability scans. Delete, don’t deactivate.
7. Images uploaded straight from the camera
4MB hero images, 3000-pixel team photos in 300-pixel containers, entire galleries in PNG. Images are the single heaviest thing on most WordPress pages and the single easiest fix: automatic WebP conversion and compression on upload, plus a one-time pass over the existing library.
8. SEO basics missing on money pages
Duplicate title tags across service pages, meta descriptions that just repeat the title, one page targeting five different services, and no schema anywhere. The site can’t rank for what it never tells Google it’s about. Usually a two-day fix that outperforms months of ‘posting more content’ on a broken structure.
9. No staging environment
Every update, every plugin experiment, every design tweak happens on the live site, which is why owners fear updates, which is why plugins go stale, which is finding #1. Staging isn’t an enterprise luxury: good hosts include it free, and it converts updates from gambling into routine.
10. Analytics measuring nothing that matters
GA is installed, sometimes twice, but no conversion events, no form tracking, no call tracking. The business knows its traffic went up or down and has no idea what the website produced. You can’t improve a number you don’t collect.
The pattern behind the pattern
None of these findings require rare expertise to fix. They persist because nobody owns the website: it was built, launched, and orphaned. That’s the actual diagnosis on most audits, and it’s why the fix that sticks is usually a maintenance relationship rather than a one-time cleanup. Sites with an owner don’t accumulate this list.
Get your own findings list: Our free audit checks all ten of these plus performance, security, and SEO specifics for your site, delivered as a prioritized report within 2 business days, by a developer, not a bot.
How many of the ten does your site have?
Most sites we audit have at least four. Find out your number, and get the fix list ranked by risk, free.
