I manage 100+ WordPress sites. Not as a thought experiment—this is my daily reality. Here’s what actually works, what doesn’t, and the systems that keep me sane.
The Scale Problem
Managing one WordPress site is easy. Managing ten is manageable. Managing 100+ is a completely different challenge. The problems don’t scale linearly—they scale exponentially:
- A plugin vulnerability affects 47 of your sites—simultaneously
- PHP updates need to be tested and rolled out across different hosting environments
- Clients expect personalized attention even when you’re managing their sites in batches
- One missed update on one site can lead to a compromise that takes hours to fix
- Tracking credentials, access, and site configurations across 100+ installs is its own full-time job
The answer isn’t working harder. It’s building systems that handle 90% of the work automatically and flagging only the 10% that needs human judgment.
The Management Stack
Centralized Dashboard: MainWP
After testing every major WordPress management tool (InfiniteWP, ManageWP, WPMU DEV, iControlWP), I settled on MainWP for a specific reason: it’s self-hosted. No monthly per-site fees, no third-party holding your credentials, and unlimited customization through extensions.
MainWP setup for 100+ sites:
- Install MainWP Dashboard on a dedicated, hardened WordPress install (not one of your client sites)
- Install MainWP Child on every managed site with unique security IDs
- Organize sites into groups: by hosting provider, client tier, site type, or update frequency
- Configure sync schedules: Hourly for uptime, daily for updates, weekly for security scans
Essential MainWP Extensions
- MainWP Bulk Updater: Update plugins and themes across all sites in one click
- MainWP Security: Run Wordfence scans across all sites from one dashboard
- MainWP Uptime Monitoring: Track uptime without relying on third-party services
- MainWP Backups: Centralized backup management (though I prefer UpdraftPlus on individual sites)
- MainWP Reports: Generate client-facing maintenance reports automatically
AI-Powered Layer: OpenClaw
MainWP handles the mechanical management. But there’s a layer above that—the judgment layer—where AI agents excel. OpenClaw connects to all your WordPress sites via the REST API and provides AI agents that can:
- Investigate issues on specific sites through natural language queries
- Generate and deploy content, fixes, and updates across sites
- Run security audits and performance checks on demand
- Automate repetitive tasks that MainWP can’t handle natively
- Provide intelligent alerting that reduces false positives by 80%+
Update Management at Scale
The Update Tier System
Not all updates are created equal. Here’s the tiered approach I use:
- Tier 1 — Security patches (immediate): WordPress core security releases and plugin vulnerability patches. Apply within 24 hours across all sites. Use MainWP to identify which sites are affected and push updates in bulk.
- Tier 2 — Minor updates (weekly): Plugin and theme minor updates (patch versions). These rarely break things. Apply weekly in bulk, with auto-rollback monitoring.
- Tier 3 — Major updates (monthly, staged): WordPress major releases and plugin major versions. Test on a staging site first, then roll out to 10% of sites, monitor for 48 hours, then push to all.
The Staging Strategy
You can’t have 100 staging sites. Instead, maintain a “canary” group of 5-10 non-critical sites that get updates first. If nothing breaks after 24-48 hours, push to the rest.
For critical client sites (ecommerce, membership), maintain individual staging environments. Most modern hosts provide one-click staging—use it.
Monitoring That Doesn’t Drive You Crazy
Uptime Monitoring
With 100+ sites, you’ll get alerts constantly if you’re not smart about it:
- Use hierarchical alerting: Site down → check if hosting provider has an outage → if yes, suppress all alerts for that host → if no, escalate immediately
- Set appropriate thresholds: 1-minute checks with 2 consecutive failures before alerting (eliminates false positives from brief network hiccups)
- Route alerts intelligently: Critical sites → SMS + email. Standard sites → Slack channel. Low-priority sites → daily digest email
Performance Monitoring
Track Core Web Vitals across all sites using a combination of:
- Google Search Console: Field data (real user metrics) for sites with sufficient traffic
- Synthetic monitoring: Weekly Lighthouse checks from a central dashboard
- Anomaly detection: AI-powered tools that alert on regressions without requiring manual threshold setting
Security Monitoring
Security at scale means automated scanning with intelligent filtering:
- Run Wordfence or Sucuri scans on all sites daily via MainWP
- Monitor vulnerability feeds (WPScan, Patchstack) and cross-reference with your active plugin list
- Automate the “patch within 24 hours” rule for critical vulnerabilities
- Use AI to reduce alert noise—filter out low-risk findings and prioritize genuinely exploitable vulnerabilities
Client Communication and Reporting
The Monthly Report
Clients pay for maintenance and want to see value. Generate monthly reports that include:
- Updates applied (count of plugin, theme, and core updates)
- Security scans completed and issues resolved
- Uptime percentage (target: 99.9%+)
- Performance metrics (Core Web Vitals scores)
- Backups completed and tested
- Recommendations for improvements
Automate this with MainWP Reports or custom scripts that pull data from all your tools and compile it into branded PDFs.
Proactive Communication
Don’t wait for clients to notice problems. Proactive communication builds trust:
- Notify clients about planned maintenance windows
- Alert them to security vulnerabilities in their plugins before they’re exploited
- Recommend improvements based on monitoring data (“Your site traffic has grown 40%—consider upgrading hosting”)
- Send quarterly performance summaries with trend data
Credential and Access Management
Managing credentials for 100+ sites is its own security challenge:
- Use a password manager: 1Password or Bitwarden with shared vaults. Every site gets a unique, strong admin password.
- Create dedicated management accounts: Don’t use the client’s admin account. Create your own (e.g., “agency-maintenance”) with a unique email.
- Use application passwords for API access: MainWP and other tools should use WordPress application passwords, not login credentials.
- Document access in a central location: Hosting panel logins, FTP/SFTP credentials, domain registrar access, SSL certificate details—all in one secure, encrypted location.
- Rotate credentials quarterly: Automated password rotation for management accounts reduces the impact of credential leaks.
The Daily Workflow
Here’s what a typical day managing 100+ sites looks like with proper systems:
- Morning check (15 minutes): Review overnight alerts, uptime status, and any failed automated tasks. MainWP dashboard shows all sites at a glance.
- Security review (15 minutes): Check vulnerability feeds against your plugin inventory. Apply critical patches immediately.
- Update cycle (30 minutes): Push pending updates for the week’s tier-2 items. Review auto-updated sites for issues.
- Client requests (varies): Handle any ad-hoc client requests—content updates, new pages, plugin configurations. Use AI to handle routine requests faster.
- End-of-day review (10 minutes): Check monitoring dashboards, ensure backups completed, review any pending items.
Total: about 1-2 hours per day for 100+ sites. Without proper systems, this would take 6-8 hours.
Automating the Boring Stuff
The biggest time savings come from automating repetitive tasks:
- New site onboarding: Create a checklist/script that installs standard plugins, configures security settings, sets up backups, and connects to MainWP automatically
- SSL certificate renewal: Use Let’s Encrypt with auto-renewal. Monitor expiration dates centrally.
- Backup verification: Automated monthly restore tests to a staging environment—verify backups actually work
- Report generation: Automated monthly report compilation and delivery
- Plugin auditing: Quarterly automated audit of all plugins across all sites—flag unused, outdated, or potentially risky plugins
When Things Go Wrong
With 100+ sites, something will go wrong regularly. The key is having systems to handle it:
Site Compromised
- Isolate: Take the site offline or block all access except yours
- Assess: Identify the infection vector (check plugin vulns, user logs, file changes)
- Clean: Remove malicious code, or restore from a known-clean backup
- Harden: Patch the entry point and apply additional security measures
- Scan: Run security scans on all other sites using the same vulnerable plugin
Update Breaks a Site
- Rollback: Use the backup to restore immediately
- Identify: Determine which specific update caused the issue
- Pause: Flag that update in MainWP to prevent it from being applied to other sites
- Report: Notify the plugin developer and check their support channels
- Monitor: Watch for a patched version before re-applying
Hosting Provider Outage
Know which of your sites are on which host. When a host goes down, you need to quickly communicate with affected clients, estimate restoration time, and decide whether any sites need emergency migration.
The ROI of Proper Management
With proper systems in place:
- Average time per site per month: 15-20 minutes (down from 2-3 hours without systems)
- Zero undetected security incidents (with proper monitoring)
- 99.9%+ average uptime across all managed sites
- Client retention rate: 95%+ (compared to 60-70% for agencies without proactive management)
- Ability to scale to 200+ sites without adding staff
The tools exist. The systems are proven. Whether you’re managing 10 sites or 100+, the principles are the same: centralize, automate, monitor, and let AI handle the judgment calls that don’t actually require human insight.
For a unified approach combining centralized management with AI-powered automation, OpenClaw provides the intelligence layer that sits on top of tools like MainWP—handling the 90% of tasks that are too complex for simple automation but too repetitive for senior developer time.
