I have managed WordPress sites since 2006 — client work, self-employed builds, and my own multi-site products. If you manage more than a handful of installs, you do not have a security problem — you have a prioritization problem. CVEs drop weekly, plugins go unmaintained, and PHP versions drift. The question is never "is there risk?" but "which site do I fix first?"
A practical triage workflow sorts your portfolio by exposure, limits each site to a short action list, and reserves alerts for changes that genuinely matter. Here is a weekly rhythm that works for agencies managing 10–100 sites.
Step 1: Score every site in one view
Start with a portfolio list sorted by risk — not alphabetically, not by client revenue. A numeric score (0–100) with a clear band (Safe, At Risk, Critical) lets you see which installs need attention today versus which can wait until Friday.
Step 2: Read the top three issues only
Per site, identify the three issues that reduce exposure fastest. Patch the active RCE before the unmaintained sidebar widget. Upgrade EOL PHP before a low-severity CVE on a plugin you are about to replace. The fix order matters as much as the fix list.
Step 3: Batch similar work
If four sites share the same vulnerable plugin, patch them in one session. If three sites run PHP 7.4, schedule hosting upgrades together. Triage is about sequencing work, not opening fifty dashboards.
Step 4: Alert on critical changes only
Disable noisy notifications. Reserve instant alerts for critical vulnerabilities and sudden score drops. Everything else can wait for the weekly digest.
Step 5: Review what changed every Friday
End the week with a portfolio summary: new CVEs, score movements, sites that crossed from Safe to At Risk. Carry forward anything unresolved.
Tools that help
Remote management tools like MainWP help you execute updates across sites. Security plugins like Wordfence protect individual installs. For prioritization across a portfolio, purpose-built triage tools like WP Triage score risk and rank fix order — or you can maintain a manual spreadsheet if your portfolio is small enough.
Ready to connect your sites? See the connecting WordPress guide.