WordPress Website Checklist: 51 Checks for 2026

The checklist behind my free WordPress inspector: 9 speed, 12 security, 20 SEO, and 10 legal and email checks, with why each one matters.

Most website owners only find out something is wrong when a customer complains or traffic drops. So I built a free inspector into DatPilot Portal that checks a WordPress site in a couple of minutes and grades it from A to F. This post publishes the full checklist behind it, so you can run it yourself even without the tool.

The checks are grouped into four areas: speed (9), security (12), SEO (20), and legal and email (10).

Speed: 9 checks

Mobile performance score. Measured with Lighthouse in a simulated 4G phone profile, not on a fast laptop.
Largest Contentful Paint. When the main content appears. Google recommends under 2.5 seconds.
Server response time. Time to first byte. Aim for under 600 ms.
Total page weight. Everything the browser downloads to show the page.
Compression. HTML should be served with gzip or Brotli.
Page caching. A cache plugin, server cache, or CDN should serve repeat visits without running PHP.
Modern image formats. WebP or AVIF instead of large JPG and PNG files.
Lazy loading. Images below the fold should not load immediately.
Plugins loaded on the homepage. Each plugin that adds scripts and styles adds weight and conflict risk.

If you only fix one thing from this list, look at what JavaScript runs during load. On my own sites, analytics tags were most of the blocking time.

Security: 12 checks

HTTPS. The site loads over an encrypted connection.
HTTP to HTTPS redirect. Someone typing http:// should still end up on the secure version.
Valid SSL certificate. Trusted, matching the domain, and not close to expiry.
WordPress version. Compared with the latest release.
Version disclosure. The generator meta tag and readme.html should not advertise your version.
Username protection. The REST /users endpoint and ?author=1 should not reveal login names.
XML-RPC. A common target for mass password guessing. Disable it if you do not use it.
Exposed debug.log. Error logs often contain paths and sometimes secrets.
Directory listing in uploads. Nobody should be able to browse a list of every file.
PHP version disclosure. The X-Powered-By header gives attackers a head start.
Security headers. HSTS, X-Frame-Options, and X-Content-Type-Options.
Known vulnerabilities. Detected plugin, theme, and core versions are compared against a public vulnerability database.

Check 21 is often the most valuable. An outdated plugin with a published exploit matters far more than a missing header.

SEO: 20 checks

Indexable. No noindex, and robots.txt does not block the whole site.
Title tag. Present and reasonably short, roughly under 60 characters.
Meta description. The snippet you would like to appear in search results.
One H1. A single main heading.
XML sitemap. Helps search engines discover pages.
robots.txt. Present and sensible.
Mobile viewport. The page is set up for phone screens.
Canonical tag. Present and pointing to the right domain.
One version of the site. www and non-www resolve to a single address.
Real 404s. Missing pages return status 404, not a “soft 404” with status 200.
Internal links. Links on the homepage are tested for errors.
Content depth. The homepage has at least about 250 words of real text.
H2 subheadings. Content is broken into sections.
Favicon. Shown next to your result in Google.
Structured data. Schema for things like ratings, products, and FAQs.
Open Graph tags. Title and description for social shares.
Share image. Present, loadable, at least 600 by 315 pixels, ideally 1200 by 630.
Image alt text. Helps search engines and screen readers understand images.
Language declaration. The lang attribute on the page.
Lighthouse SEO score. A summary score for technical basics.

Legal and email: 10 checks

Many of these come from Vietnamese e-commerce rules, since the portal serves Vietnamese businesses first. The email checks apply everywhere.

E-commerce registration badge. Vietnamese online stores must notify the Ministry of Industry and Trade and display its badge.
Privacy policy. Personal data handling, in line with Vietnam’s Decree 13/2023 on personal data protection.
Return and warranty policy. Required for online stores.
Shipping policy. Required for online stores.
Terms and operating rules.
Business information. Company name and tax ID or business registration.
Contact details. Phone number and address.
SPF record. So email sent from your domain does not land in spam.
DMARC record. Stops others from spoofing your domain.
DKIM signature. Authenticates outgoing mail. This one is advisory, because custom selector names often make it impossible to detect from outside.

A lesson from building the tool: order matters

My first version ran Lighthouse at the same time as the other checks to save time. The scores came out worse than reality, because the other checks were competing for CPU and inflating Total Blocking Time. Lighthouse now runs after everything else, alone. If you test performance, never run it next to other heavy work.

How to use this list

Fix every failure in security checks 15 to 21 first. They are cheap to fix and expensive to ignore.
Then work through speed, measured on a phone profile.
Treat SEO items as hygiene: none of them make you rank, but each one can stop you from ranking.
If you sell online in Vietnam, the legal group is not optional.

You can run all 51 checks for free at app.datpilot.com/kiem-tra. The interface is in Vietnamese, but the report is easy to follow, and it works on any public WordPress site.