Managing & Maintaining 150+ WordPress Sites for a US Agency

For two and a half years I worked full time with Cloud Nine Web Design, a web agency in Morris, Illinois. Alongside building new sites, I was responsible for keeping a portfolio of more than 150 live WordPress sites healthy, fast and online.

Maintenance at that scale is a different discipline from building one site well. It is about process, triage and not breaking things.

What the work actually involved

Updates without surprises

Core, theme and plugin updates across 150+ sites, staged rather than fired blind: staging first for anything non-trivial, visual regression checks on key templates, and a rollback path ready before the update runs. Sites on the same stack were grouped so one tested update could be rolled out with confidence.

Security and hygiene

• Hardening: file permissions, disabled file editing, login protection, principle-of-least-privilege user roles.
• Abandoned and vulnerable plugins identified and replaced — the single largest source of real-world WordPress compromise.
• Malware cleanup and recovery when a site arrived already infected, including finding the entry point so it did not come back.
• Backup verification. A backup nobody has restored is a hypothesis, not a backup.

Performance

• Core Web Vitals work on sites that could not be rebuilt: image conversion and sizing, render-blocking asset cleanup, database overhead, caching and CDN configuration.
• Replacing heavyweight plugins with a few dozen lines of custom code where a plugin was carrying 400KB to do one small job.
• Hosting-level diagnosis when the bottleneck was PHP workers or a slow database rather than the front end.

The request queue

The unglamorous majority of the work: content changes, new landing pages, form logic, integrations, “this broke after the update”, “can we add a booking system”, redesigns of individual templates. Clear communication and fast turnaround matter more here than clever code.

What I took away from it

• Boring is a feature. On a site someone’s business depends on, the clever solution is usually the wrong one.
• Document as you go. With 150 sites, the version of you from three months ago is a stranger.
• Triage honestly. Telling a client that a request is a two-hour job rather than a fifteen-minute one, before starting, buys more trust than heroics afterwards.
• Agencies need a developer who communicates in plain English. Most of my working day was written updates to account managers, not code.