WordPress plugin · v1.0 · 1,000+ installs

Audit your WordPress
site with AI.
Fix what matters in minutes.

SecureAuditWP runs a deep security audit powered by ChatGPT, Claude, or Gemini — then writes you a hardening checklist based on 12 years of cleaning hacked WordPress sites. Export and print a professional report in one click.

Install from WordPress.org See sample report →
★★★★★ 4.9 · 312 reviews Free forever plan No credit card
/wp-admin/admin.php?page=secureauditwp

Audit · my-store.com

Using Claude Sonnet 4.5
64out of 100
Critical issues3
High7
Passed checks47
Outdated plugin: contact-form-7 5.4.1 Known CVE-2023-6449 · Stored XSS · Update to 5.9.5
CRITICAL
wp-config.php is world-readable Set permissions to 600 to prevent credential leaks
HIGH
2 admin accounts with weak passwords Detected via NIST 800-63B compliance check
HIGH
SSL/TLS configured correctly HSTS, valid certificate, TLS 1.3
PASS
Powered by leading AI models OpenAI ChatGPT Anthropic Claude Google Gemini Built for WordPress 6.4+
Choose your AI

Bring your own intelligence.

Use any major AI provider — connect once with your API key, switch any time. Your site data never goes through our servers.

ChatGPTOpenAI

Reliable, well-documented, and excellent for parsing log files and PHP code patterns.

gpt-5 gpt-4.1 o4-mini
ClaudeAnthropic

Best-in-class reasoning for complex security analysis and detailed remediation steps.

claude-opus-4 claude-sonnet-4.5 claude-haiku-4.5
GeminiGoogle

Massive context window — ideal for sites with thousands of plugins, files, or log lines.

gemini-2.5-pro gemini-2.5-flash

API keys stored encrypted in your WordPress database. SecureAuditWP never sees them.

How it works

Three steps to a hardened site.

Connect, audit, fix. The whole loop takes a coffee break.

STEP 01

Connect your AI

Paste your API key from OpenAI, Anthropic, or Google. Stored locally and encrypted — nothing leaves your server unless you say so.

STEP 02

Run the audit

SecureAuditWP scans 60+ checkpoints — files, database, users, headers, plugins — and feeds findings into the AI for prioritized analysis.

STEP 03

Fix & export

Walk through plain-language fixes — most are one-click. Export a printable PDF report for clients, compliance, or your own records.

Features

Everything you need to lock it down.

Built from years of cleaning real WordPress hacks. Every feature exists because a site got owned without it.

AI-powered analysis

Findings ranked by exploitability and impact — not just severity. Tailored to your stack.

Printable PDF reports

One-click export. Branded, dated, with executive summary — perfect for clients and auditors.

Continuous re-scans

Schedule weekly or monthly audits. Get email digests when posture drifts.

One-click hardening

Apply common fixes directly: file permissions, security headers, login lockdown — without leaving WP.

CVE database lookup

Cross-references all installed plugins and themes against the latest WPScan and NVD CVE feeds.

Multi-site support

Agencies: manage audits across all your WordPress installs from a single dashboard.

Compliance presets

Map findings to PCI-DSS, GDPR, HIPAA, and OWASP Top 10 — useful for regulated industries.

Hack recovery mode

Site already breached? Switch to forensic mode for malware scans, indicator-of-compromise hunting, and rollback help.

Privacy-first

Audits run on your server. Only findings are sent to the AI you chose — no source code, no PII, ever.

Sample report

A report your client can actually read.

Every audit produces a polished PDF — executive summary, ranked findings, remediation steps, and a compliance map. Print it, email it, file it.

  • Plain-English explanations alongside CVE references
  • White-label with your agency logo & brand colors
  • Severity-ranked, with estimated time to fix
  • Export to PDF, HTML, or CSV
Download example PDF →
SECURITY AUDIT REPORT
my-store.com
Apr 27, 2026 · Audit #A-04829 · SecureAuditWP v1.0
FAIL
3 CRIT
3Critical
7High
14Medium
47Passed
Top findings
Outdated plugin · Contact Form 7 Stored XSS · update 5.4.1 → 5.9.5
CVE-2023-6449 CRIT
wp-config.php permissions World-readable · should be 600
CIS 5.1.4 CRIT
Admin user with weak password 2 accounts fail NIST 800-63B
OWASP A07 HIGH
Missing security headers CSP, X-Frame-Options, Referrer-Policy
OWASP A05 HIGH
XML-RPC enabled Brute force vector · disable if unused
CIS 7.2 HIGH
Page 1 of 14 Generated by Claude Sonnet 4.5
What we check

60+ checkpoints, every scan.

The same playbook used to clean over 500 hacked WordPress sites — now automated.

Outdated core, plugins & themes

Cross-references every component against the latest stable releases and known CVEs.

File permissions & wp-config hardening

Verifies 644/755/600 across critical paths and flags exposed configuration files.

User accounts & weak passwords

NIST 800-63B compliance check, dormant admin detection, and role over-privilege audit.

Database security

Default table prefixes, SQL exposure paths, orphaned data, and credential leaks.

Login & brute force protection

Rate limiting, 2FA enforcement, XML-RPC posture, and login URL obscurity.

SSL, headers & CSP

TLS version, HSTS, CSP, X-Frame-Options, Referrer-Policy, and mixed-content scan.

Known CVEs in installed plugins

Live cross-check against WPScan, NVD, and Patchstack feeds with exploit-in-the-wild flags.

Malware & suspicious code

Heuristic scanner for obfuscated PHP, base64 payloads, and known shell signatures.

Portrait of the SecureAuditWP founder at his desk, with code, a world map of attacks, and a threat-model whiteboard in the background
Built by an expert

I've cleaned 500+ hacked WordPress sites. Now you don't have to call me.

SecureAuditWP encodes 12 years of incident response into an AI-driven audit. Every finding, every recommendation comes from a real breach I worked on. The plugin asks the questions I'd ask, in the order I'd ask them.

12Years in cybersecurity
500+WordPress sites cleaned
3Industry certifications
✓ OSCP ✓ CompTIA Security+ ✓ CompTIA Pentest+
Loved by site owners

Real users, real wins.

★★★★★
"Caught an XML-RPC brute force I'd been ignoring for months and walked me through fixing it in 10 minutes. The PDF report alone is worth the price — clients love it."
JM
Julia MarinFreelance WP Developer · Madrid
★★★★★
"We run 47 client sites. Before SecureAuditWP we needed two part-time security people. Now one person handles audits across the whole portfolio in an afternoon."
DR
Devon RothCTO, Northwind Agency
★★★★★
"My e-commerce site got hit with a fake login plugin malware. The hack-recovery mode found the backdoor in three minutes. Saved me a $2k cleanup invoice."
AT
Aisha TranOwner, Petalworks Boutique
Pricing

Simple, fair pricing.

Free forever for personal use. Upgrade to Pro when you need scheduled audits, white-label reports, or multi-site.

Free

$0/forever
For hobbyists and single sites
  • Manual audits, on-demand
  • All 60+ security checks
  • Bring your own AI key
  • Basic PDF export
  • Single site
Install free

Pro

$89/year
For agencies and serious operators
  • Everything in Free
  • Scheduled weekly & monthly audits
  • White-label PDF reports
  • Multi-site dashboard (up to 25 sites)
  • Compliance presets (PCI, GDPR, HIPAA)
  • Hack recovery mode
  • Priority email support
Get Pro — $89/yr

Need more than 25 sites? Talk to us about Agency.

FAQ

Frequently asked.

Still curious? Email the founder directly — replies within 24h.

Does my site data go to OpenAI/Anthropic/Google?

Only the audit findings (titles, severity, generic descriptions) go to the AI you chose. We never send source code, database dumps, user PII, or credentials. The audit itself runs entirely on your server.

Do I need an AI API key?

Yes. SecureAuditWP is "bring your own key" — you'll need an account with OpenAI, Anthropic, or Google AI Studio. A typical full-site audit costs between $0.05 and $0.30 in API usage depending on the model.

Will it slow down my site?

No. Audits run on-demand or on a schedule and use a low-priority background process. Average runtime is 90 seconds for a typical site, with no impact on front-end performance.

What WordPress versions are supported?

WordPress 6.0+ on PHP 7.4 or higher. Tested on PHP 8.0, 8.1, 8.2, and 8.3. Multisite is supported on the Pro plan.

Can I white-label the PDF reports?

On the Pro plan, yes — replace the SecureAuditWP logo with your own, add custom cover pages, and set your brand colors. Reports look like they came from your agency.

What if my site is already hacked?

Switch to Hack Recovery mode (Pro). It runs a malware-aware scan, checks for indicators of compromise, and gives you a step-by-step cleanup playbook based on real incident response work.

Is there a refund policy?

30-day money-back guarantee on Pro. No questions asked — just email us.

Stop guessing. Start auditing.

Free forever for one site. Install in 60 seconds — no credit card, no signup.

Install from WordPress.org View on GitHub

⭐️ 4.9 / 5 from 312 reviews · 1,000+ active installs · GPL-2.0 licensed