The audit checklist
| Area | What to check |
|---|---|
| Updates | how current the OS, web server, runtime, CMS and plugins are; known CVEs |
| Access | who holds SSH or admin rights, weak and empty passwords, stray keys |
| Open ports | what is reachable from outside; close the rest at the firewall |
| Exposed configs | readable .env and .git, backups and dumps left in the web root |
| Malware and integrity | modified files, backdoors, nulled plugins, rootkits |
| Logs and logins | suspicious sign-ins, attacks in the web logs, brute-force protection |
| Backups | whether they exist, whether they are fresh, whether a restore was ever tested |
Where to start
- •Close the obvious: updates, unnecessary open ports, exposed configs, weak passwords,
- •Check the site itself for infection,
- •Make it recurring: a one-off audit goes stale, continuous monitoring does not.
How to check the site specifically for malicious code is in how to check a website for malware. Why pirated extensions are a leading entry point is in why nulled plugins are dangerous, and the backup side is in website backup strategy.
How to automate it
Walking the checklist by hand every time is slow. ServerShield connects over SSH, runs all of it automatically and returns a readable, prioritised report. You can start a scan from Pulse.
Frequently asked questions
How often should we audit a server?
A basic audit at least quarterly, and after any major change — a migration, a new service, an incident. Vulnerability and integrity monitoring is better kept continuous: new CVEs and new infections appear all the time.
Do we need our own security specialist for this?
Not for a one-off audit, provided you use a tool that works through a checklist and returns a readable report. A permanent security team is for large organisations; mid-sized business is well served by a regular automated check.
Could the audit break a production server?
A proper audit is read-only: it inspects the state — versions, configs, logs — and changes nothing. That is how ServerShield works: it connects over SSH and collects facts without touching the server.