WordPress security for agencies and client sites

Why agencies need a different approach

An agency’s risk isn’t one site, it’s the weakest of all of them. Client sites differ in plugins, hosts and how often anyone looks at them, and one compromised site can damage a client relationship and your reputation. What works for a single site, logging in and checking, doesn’t scale to dozens.

What the Agency plan adds for WordPress security for agencies

• Multi-Site Hub: every licensed site in one view.
• Cross-Site Threat Intelligence: attack signals seen on one of your sites inform the others.
• Incident Response Playbooks: automated response steps for common incident types.
• Session controls: New-Device Login Approval, Session Fingerprinting, Active Session Monitoring and Step-Up Verification.
• Auto-Suspend Rogue Admins and a Custom Folder Scan for non-standard installs.
• Live chat support, plus tickets, with replies shown inside WordPress.

And everything in Pro: Deep scans, the JS & Card-Skimmer Scanner, Live CVE Correlation, the WAF Rules Manager and Sandbox, Country Blocking, the Network IP Blocklist and immediate live signatures and rules. Every site also gets the baseline that’s on every plan: a firewall with 356 built-in rules, 2FA, brute-force protection, 16 one-click hardening checks and an instant alert when a new administrator appears.

A security workflow that scales

1. Standardise. Apply the same hardening and login rules to every client site at onboarding.
2. Centralise alerts. Route new-admin alerts and weekly digests to a shared agency inbox, not one person’s.
3. Patch on a schedule. Use known-vulnerability data to prioritise which sites to update first.
4. Separate access. One account per person per site, with 2FA, removed when people leave.
5. Rehearse incidents. Know who does what in the first hour before it happens.

When a client site is hacked

Contain first (maintenance mode and evidence backup), then lock the attacker out, then clean. Tell the client early, with what you know and what you’re doing about it. Our hacked site recovery plan gives the order of operations, and the Pro Forensic Evidence Bundle collects the logs, files and differences you will want when explaining what happened.

Licensing for many sites

An Agency license covers up to 10 sites, and Pro covers 3. A license can move between sites: deactivate it on one and activate it on another. Compare plans on the pricing page.