secaudit checks your WordPress site from the inside: malware, the code of your own plugins, file integrity and known vulnerabilities. You get a plain to-do list, and a public page with a seal that anyone can check on secaudit.eu.
Mapped to GDPR Art. 32 · NIS2 Art. 21 · CRA · OWASP Top 10:2025
Add it to WordPress like any other plugin. The scans run on your own server, so your files stay where they are.
No alarms, no jargon: it repairs what it safely can and explains the rest in plain words, most important first.
Work through the list. When your score is good, publish your verification page and put the seal in your footer.
Each finding is tied to the rule an auditor or a customer will ask about.
Accounts, orders and contact forms need up-to-date software, strong logins and encryption. secaudit shows which of your settings relate to it.
GDPR Article 32 for WordPressIf your company is in scope, you must handle updates, access, two-step login and incidents. secaudit maps each finding to the Article 21 measures.
Does NIS2 apply to your site?If you sell plugins or themes, you must handle vulnerabilities and report the serious ones in time. secaudit helps you prepare for the 24-hour and 72-hour deadlines.
The CRA for plugin and theme sellerssecaudit gives a technical view of your site, not a legal assessment.
Not a surface scan: it reads the code your site actually runs.
Signatures, hashes and entropy checks catch hidden code, uploaded shells and injected spam links, with optional ClamAV on your server.
How to remove WordPress malwareReads the PHP in your plugins and themes for SQL injection, XSS, file inclusion and missing CSRF checks.
OWASP Top 10:2025 for WordPressRecords every file, flags what changed and checks WordPress core against the official checksums.
Signs your site was hackedChecks plugins, themes, core and PHP against current releases and known CVEs, and flags versions that no longer get updates.
Handling vulnerable pluginsQuarantine, firewall and two-step login in the same plugin, with every event written to a log you can read.
WordPress security checklistEvery finding mapped to GDPR Art. 32, NIS2 Art. 21, the CRA and OWASP, on screen. Signed report documents come with Pro.
The 72-hour breach ruleAll prices in euros (EUR), VAT included. Paid plans renew every year; cancel any time.
€0EUR
free plugin for every site
€79EUR
per year, 1 site
€199 EUR per year for 5 sites
€399EUR
per year, 25 sites
€899 EUR per year for 100 sites
Early access. Until the online checkout opens, Pro and Agency services are available to every site at no charge. We collect no payment details during early access, and nothing turns into a paid plan by itself. When early access ends, the services stop on sites without a plan. We announce the end date here at least 14 days ahead.
No. It shows a real, dated score from the plugin's checks, and anyone can open the page behind it. If the score drops or the scans stop, the seal is downgraded or disappears. No scan can prove that a site can never be hacked.
No. No tool can do that for you. secaudit shows which GDPR, NIS2 and CRA measures your site's settings touch and what to fix there. Whether your business complies also depends on how you work, so your adviser has the last word. It is a technical view of your site, not a legal assessment.
No. Each finding comes with one plain sentence and a clear next step, in the order to fix them.
The scans run where your site runs. For the public page, only the score, the date and the state of the seal are sent. Pro services such as off-site scanning send files to our servers only when you turn them on.
Online purchase is not open yet. We will announce the date here at least 14 days before early access ends. Prices are in euros (EUR) and include VAT; the checkout shows the final price before you pay. Paid plans renew every year, and you can cancel at any time.
Each address: every domain, every subdomain and every path of a multisite network is one site.
Yes. Full refund within 14 days of a payment, including each renewal, no questions asked. See the refund policy.
AngelForce OÜ in Tallinn, Estonia. Write to info@secaudit.eu any time.
Practical guides on WordPress security and the EU rules behind it, in 8 languages.
A simple IT risk assessment for WordPress sites: list assets, name threats, rate on a 1–3 scale, pick measures and owners, with a worked example register.
WordPress HTTPS done right: free certificates, safe URL replacement with WP-CLI, one 301 redirect, proxy redirect loops, mixed content and expiry checks.
WordPress keeps getting hacked after cleanup? Find the backdoors that survive: auto_prepend_file, mu-plugins, fake plugins, cron, sibling sites, open entry points.
