The auditor behind the audit.

Who builds Lockora Audit

Lockora Audit is built and maintained by G. Schad, a cybersecurity specialist based in San Francisco, USA, certified under Germany’s Federal Office for Information Security (BSI) framework.

Over the past 8 years, G. has audited several hundred WordPress websites — for agencies managing large client portfolios, ecommerce stores, publishers, membership sites, and custom business platforms. The same findings kept coming back: stale plugins with known CVEs, one-click installs that never replaced their placeholder salts, admin accounts nobody remembered creating, and xmlrpc.php quietly absorbing brute-force traffic.

Lockora Audit is those years of manual audit checklists turned into a plugin: the checks that actually catch compromises, explained the way a good consultant would explain them — what the issue is, why it matters, and what to do about it.

• BSI-certified cybersecurity specialist Certified under the German Federal Office for Information Security framework, now working from San Francisco.
• 8 years of hands-on WordPress auditing Several hundred sites audited across agencies, ecommerce, publishing, and membership platforms.
• Three plugins in the WordPress.org directory Lockora Security Audit, Who Changed It?, and WPSecureOps Connector — all listed on the author’s WordPress.org profile.
• Independent and privately built Not affiliated with Automattic, WordPress.com, or any hosting provider. No investors, no data resale.

Why another security plugin?

Wordfence and Sucuri are good at what they do: firewalling and real-time signature scanning. But most of the compromises found in real audits do not start with malware a signature can match. They start with configuration — placeholder secret keys, a debug log left reachable, a forgotten administrator account, an XML-RPC endpoint nobody uses, a plugin two versions behind a public advisory.

Finding those things used to mean a human auditor working through a checklist, site by site. Lockora turns that checklist into a scan you can run from the admin or from WP-CLI, scores the result out of 100, and explains each finding in plain English. On WordPress 7 it can also write the client-facing report for you, from sanitized findings only, using whichever AI provider you connect.

The blog works the same way: every guide on the Lockora blog is written from patterns seen in actual audits, not compiled from other blog posts. If a recommendation is only marginally useful (like hiding your login URL), the guide says so.

How I audit a WordPress site

The same five passes, every site. The plugin automates the repeatable parts; the judgement calls stay with a person.

1. Inventory and update posture

   What is installed, what is abandoned, what is behind a public advisory. Most mass compromises start here.

   In the plugin: core, plugin and theme update checks, auto-update posture, optional vulnerability matching with a Wordfence Intelligence key.
2. Integrity of what is on disk

   Do the core files match the official release? Is there PHP where only uploads should be? Are backups or secrets sitting under the web root?

   In the plugin: core checksum verification with CSV/TXT export, bounded wp-content anomaly scan.
3. Configuration and secrets

   Salts, table prefix, must-use plugins, HTTPS and headers, and whether debug output or version information leaks to the internet. The wp-config.php guide covers the details.

   In the plugin: salt checks with generate/rotate actions, header checks, debug.log and readme.html reachability.
4. Accounts and exposure

   How many Administrators, which are stale, whether usernames leak through author archives or the REST API, and whether login protection exists. The user roles guide walks through the review.

   In the plugin: admin posture checks, author enumeration and user ID 1 checks, login-protection and 2FA plugin detection, REST user route and XML-RPC toggles.
5. Transport and platform

   Certificate expiry, PHP version support, and the hardening constants that decide what a compromised admin can do.

   In the plugin: SSL expiry check, PHP version status from WordPress.org, Site Health integration. See it in the getting-started guide.

Principles the plugin is built on

• Read-only by default. A scan never changes anything. The four hardening toggles are opt-in and reversible, and nothing is ever applied automatically.
• Your code stays yours. File contents, passwords, salts, API keys, raw logs and user lists do not leave the site. The optional AI client report receives sanitized findings only, and only when you click Generate Client Report.
• Honest severity. The score is weighted by what actually gets sites compromised, not by whatever produces the scariest-looking report.
• Plain English. Every finding explains the what, the why, and the how — written for the person who actually has to fix it.

The full capability list is on the homepage: what Lockora does and doesn’t do →

Plugins by the same author

All three are free in the WordPress.org directory and maintained by G. Schad. Install counts and ratings are the directory’s own figures.

Get in touch

Questions about the plugin, an audit finding, or agency use? Email goes straight to G. — there is no support tier between you and the person who wrote the code.