How to manage security across multiple WordPress sites

List every domain, hosting account, WordPress version, PHP version, administrator, backup destination and business owner. Include staging sites and old sites that still have public URLs. A forgotten installation is often the one that stays vulnerable.

Group sites by importance and similarity, such as brochure sites, shops and membership sites. Record which sites can tolerate automatic updates and which need a maintenance window.

Use HTTPS, remove unused plugins and themes, delete inactive administrator accounts, require strong unique passwords and enable two-factor authentication for privileged users. Keep file and database access limited to the people and services that need it.

Check WordPress Site Health and your hosting controls for outdated PHP, debug mode, error display and insecure database or file access. WordPress also recommends obtaining core software from official sources and keeping a tested backup plan before security-related changes.

For a small number of sites, log in to each WordPress dashboard on a fixed schedule. Review available core, plugin, theme and translation updates, inactive extensions, new users, failed-login alerts, Site Health warnings and recent backup results.

Update one low-risk site first, check the front end, administrator login, forms, checkout and key integrations, then continue with the rest. This route costs more time and makes omissions likely as the portfolio grows; WordPress specifically advises having a current backup before updating plugins.

Keep automated database and file backups outside the web server, retain several restore points and test restoring at least one site. A backup that has never been restored is only an assumption.

Take a fresh backup before bulk updates or major configuration changes. Separate sites where possible so one compromised hosting account or failed restore does not affect the whole portfolio. MainWP documentation also warns that backup storage settings and backup management are separate concerns, so verify where archives actually go.

Synchronise your site list, review what will change, and update trusted core, plugin and theme components in small batches. Do not automatically update every extension just because it is available; confirm compatibility for payment, caching, security and custom-code components.

Keep rollback or restore instructions ready, and check each site after the update. A central management system can update core, plugins, themes and translations across connected sites, while allowing trusted items, ignored updates and rollback actions to be managed separately.

Set alerts for malware findings, uptime failures, unavailable backups, unexpected administrator accounts, outdated software and failed update jobs. Review alerts daily for important sites and at least weekly for the rest. A notification is useful only if someone owns the response.

If a site is compromised, isolate it, preserve logs and a copy of the affected files, change hosting, database, WordPress and administrator credentials, then restore from a known-clean backup or rebuild from trusted software. Do not simply delete the visible spam and assume the infection is gone.

The fast route is to connect all sites to one management dashboard, organise them with tags, run security and Site Health checks, apply updates in controlled groups, and keep reports and alerts in one place. MainWP documentation describes central checks for outdated software, insecure settings, inactive extensions, SSL and debug configuration, plus bulk site management.

MainWP Jetpack Protect is a suitable option if you want centralised malware scanning, firewall protection, updates, alerts and security reports for multiple installations. Use it alongside tested backups and a review process; a dashboard reduces missed work but does not replace recovery planning.