Why your site is slow, found where it actually is

• Basic audit: $495.About four hours of work. Automated tests plus a manual look at speed, security basics, SEO basics and accessibility basics, and a short written summary of what is wrong and the order to fix it in.
• Deep audit: $1,500.The whole site (up to about 30 pages; larger sites are quoted), taken apart properly. Hosting, caching and server profiling. A full crawl. A security and malware check against the official releases. Your plugins and theme reviewed one by one. Who controls your domain, hosting and accounts. DNS, TLS and email tested, not assumed. A competitor benchmark. Then a designed written report with a prioritised plan and hour estimates, plus a walkthrough call. This is the depth a recent client got, the kind of work agencies price in the thousands.
• Whole-business audit: $2,950.Everything in the Deep audit, plus a rehearsal of the risky updates on a local copy of your site before anything touches the live one, a platform-options analysis (stay, rebuild, or move), and 30 days of follow-up questions answered.

The written report is yours to keep, and you can hand it to any developer. Fixes are quoted separately, with an estimate up front.

The Deep audit covers all of this. The Basic audit takes a lighter pass at speed, security, SEO and accessibility.

• Hosting.Is the plan itself the bottleneck? PHP version, whether the page cache and the code cache are on, what a current plan would add. It is often the biggest single lever.
• The server and the cache.Is the page cache working? Object cache? Is PHP running out of workers under load?
• The database.Slow queries, bloated tables, plugins storing junk in places that load on every page.
• The front end.Render-blocking files, oversized images, page-builder bloat.
• Optimizations already in place.A caching plugin, minification, image tools, builder settings: is each one helping, doing nothing, or fighting another?
• Real load, not one visitor.A site that is fine for one person can fall over for fifty. I wrote an open-source load-testing tool for exactly that, MicroChaos CLI.
• Security and signs of malware.Core and plugin files compared with the official releases, injected or disguised code, files that don’t belong, unknown admin accounts, and the server’s own logs for who is probing and what got through.
• Plugins and theme.Every one inventoried: outdated, abandoned or known-vulnerable (each issue cited to a public source), what you can drop, what you are paying for twice.
• Workflows.How the site actually gets edited, updated and backed up, by whom, and whether a backup would really restore.
• Upgrades and improvements.The updates worth doing, the lighter replacement for a heavy plugin, quick wins versus bigger projects, each with hours.
• Trouble spots.What is likely to fail next: expiring access tokens and certificates, end-of-life software, anything that rests on one person or one login.
• The rest of the business.Who owns the domain and the hosting account, who can reach DNS, whether your email is authenticated, and whether your site is quietly leaking something. The slow page is often the smallest problem on the list.

If your site is a few pages and it is slow because of WordPress, the fastest version is a static site. It has no database and no PHP, and it is served from Cloudflare’s edge. See moving off WordPress. And if it is simply broken right now, start with a rescue.