With five client sites, you can keep everything in your head. You know which one has the fussy slider, which client panics about their shop, and which host is slow on Fridays. With thirty, you cannot. Updates start getting skipped on the sites nobody complains about. A backup fails silently for weeks. Someone updates a plugin on the wrong site because two logins look the same in the browser.
The jump from a handful of sites to many is not mainly a tooling problem. Tools help, but agencies that look after lots of WordPress sites well tend to share something less exciting: a written routine that runs the same way every week, whoever is doing it. This post is about building that routine, and about choosing tools to support it rather than the other way round.
Start with an inventory you trust
Before any routine, you need a list of what you are looking after. Not a rough idea; a list. For each site, record:
- Client name and site URL
- Staging URL, if there is one
- Host and plan
- Where the domain and DNS are managed
- Theme and page builder
- Premium plugins and where their licences live
- What the site does that matters most: shop, bookings, membership, lead forms
- What your agreement with the client covers
- Any known quirks
The last two items are the ones that save you. Knowing that a site’s agreement covers updates but not content edits stops your team giving away work. Knowing that a site’s menu breaks if a certain plugin updates stops a Monday-morning emergency.
Keep this inventory in one place your whole team can see, and treat any site missing from it as a problem to fix today. For the deeper notes that sit behind each line, see our post on writing a runbook for each client site.
Group sites by risk, not by client
Not every site deserves the same attention. A brochure site for a local accountant and a busy online shop both need care, but a broken checkout costs one of them money every hour, and a broken gallery barely affects the other.
A simple three-tier grouping works for most agencies:
- High risk: stores, booking sites, membership sites, anything handling payments or personal data, and sites with heavy custom code. Updates here are tested on staging first, checked carefully afterwards, and scheduled for times when someone can respond if they go wrong.
- Medium risk: sites with forms that generate leads, page builders, or a moderate number of plugins. Updates are tested but can be batched.
- Low risk: simple sites with few plugins and no transactions. Updates can be applied in a batch, with a quick visual check after.
Grouping like this lets you spend your effort where breakage would hurt most, without neglecting the quiet sites.
A weekly and monthly routine
The exact rhythm depends on your agreements and your team. The point is to write it down so it does not depend on memory. Here is a shape that works for many agencies:
Every week
- Check that the last backup for every site completed, and that it is stored off the server.
- Review uptime alerts from the past week and confirm each one was explained.
- Check for security updates to plugins or themes in use, and apply them according to each site’s risk group.
- Clear the queue of small client requests that came in.
Every month
- Apply the routine plugin, theme and core updates, following the staging-first rule for high-risk sites.
- After updating, check the pages and functions that matter on each site: forms submit, checkout completes, key pages render.
- Review the user list on each site for accounts that should not be there.
- Check disk space and PHP version notices from hosts.
- Send each client their report.
Every quarter
- Test a restore from backup on a sample of sites, ideally to a staging copy.
- Review the plugin list on each site and remove what is no longer used.
- Check licence renewals coming up in the next quarter.
- Review the risk grouping. Sites change, and a brochure site that added a shop belongs in a different group.
Turn this into a checklist your team ticks for each site. The list matters more than whoever runs it.
What kinds of tools help
There are several categories of tools for looking after many WordPress sites. Which product in each category suits you depends on your hosting, your budget and how your team works, so treat this as a map of what to look for, not a recommendation of specific products.
Central dashboards
A number of services and self-hosted tools let you connect many WordPress sites to one dashboard, see pending updates across all of them, and apply updates from one screen. Some also handle backups, uptime checks and reports. They save a great deal of logging in and out. When evaluating one, ask how it connects to each site, what access it needs, what happens if the service itself has a problem, and whether updates can be run in batches you control rather than all at once.
A central dashboard is also a single point that has access to every client site you manage. Protect its login accordingly, with two-factor authentication and as few people as possible holding full access.
WP-CLI
WP-CLI is the official command-line tool for WordPress. If your hosts give you SSH access, it lets you list plugins, run updates, check core files and much more from the command line, and it can be scripted across many sites. It suits teams with some technical confidence and hosts that allow SSH. The official handbook on developer.wordpress.org documents its commands.
Uptime monitoring
An external monitor checks each site from outside on a schedule and alerts you when it stops responding. This is the simplest way to hear about problems before the client does. Route alerts to a shared channel rather than one person’s phone. If you are deciding which checks to configure, this explainer on monitoring a site from outside goes through the options.
Off-site backups
Host backups are useful, but if the hosting account itself is the problem, they may not be reachable. A second, independent backup stored elsewhere covers that case. Whatever you use, confirm it reports failures clearly, because a backup tool that fails silently is worse than knowing you have none.
Shared records
A shared place for site notes, a password manager for credentials, and a ticket or task system for client requests. None of these is WordPress-specific, and all of them matter more as the number of sites grows.
Standardise wherever you can
Every difference between sites is something to remember. If most of your sites use the same form plugin, the same caching approach, the same security setup and the same backup method, then the routine above is the same on every site, and problems on one site teach you about the others.
You will never make every site identical, especially inherited ones, but you can steer new builds towards a standard set and gradually move older sites over during redesigns. Our post on choosing a standard plugin stack explains how to decide what goes on that list.
Be clear about what you are actually selling
As you scale, the line between routine care and ongoing decision-making gets blurry. Updates, backups and monitoring are a predictable, repeatable job. Deciding what the site should do next, editing content and reviewing analytics is a different job that needs judgement and time. Clients often do not know the difference, so it helps to be precise in your agreements about which one each client is paying for. We wrote up how ongoing care differs from taking charge of a site for business owners, and it can help when you explain your tiers.
People and handoffs
Routines break down at handoffs: when the person who usually runs updates is on holiday, or when work moves between team members. A few habits help:
- Every site has a named person responsible for it, with a named backup.
- Every change is logged with who did it, when, and what was checked afterwards.
- Anything unusual found during a routine run is written into the site’s notes, not just mentioned in chat.
- New team members follow the written checklist exactly for their first few runs, alongside someone experienced.
If you share the routine work with an outside partner, these habits matter even more. They are what let someone in another time zone run your Tuesday updates while your team is offline, without needing to ask you anything.
When to stop adding sites
Every routine has a capacity. If updates keep slipping, reports go out late, or the same person is working evenings to keep up, that is a signal, not a personal failing. Either the routine needs simplifying, the team needs to grow, or part of the work needs to go elsewhere.
The guide for agencies outsourcing WordPress work covers the options when you reach that point. If the recurring part is what is stretching you, our page on care for your client sites delivered in your agency’s name explains how we run that routine for agencies and report back to you.
Next in this series: Agency Staging Workflow for WordPress Client Sites
