A review that lists a hundred “issues” is not a security audit, it is a scanner export with a logo on it. The job is to find the things that actually put the site at risk, in the order they matter, and to say so plainly.
This is the order I work in.
1 · Is it already compromised
Before anything else: are there signs the site is already infected? Unknown admin users, modified core files, suspicious files, unexpected redirects, spam pages. Hardening a site that is already hacked just locks the attacker in with everything else, so this comes first.
2 · How does anything get in
Then the front doors: outdated WordPress core, plugins and themes with known vulnerabilities, abandoned plugins no longer receiving updates, and weak or reused admin passwords. Most compromises come through one of these, not through something exotic.
3 · Who can do what
User accounts and permissions. How many admins exist and whether they all need to. Whether file permissions are sane. Whether logins are protected against automated guessing. Access is where a small oversight becomes a large problem.
4 · What happens if something slips through
Backups, and whether they are recent, off-site, and actually restorable. A good backup turns a serious compromise into an inconvenience; the absence of one turns a small one into a disaster.
5 · Configuration hygiene, last
The smaller hardening steps — disabling file editing in the dashboard, security headers, tidying exposed information. Genuinely worth doing, and genuinely not the thing to fix first on a site with an unpatched plugin.
What comes out of it
Not a hundred items. Usually a short list of what actually matters, in the order it should be done, with an honest note on which steps reduce real risk and which are hygiene. No guarantees of being “unhackable” — just a site that is a meaningfully harder target.